kubeadm (1.35.5-ubuntu22.04u7) jammy; urgency=low

  * [CRITICAL] CVE-2026-33186 in google.golang.org/grpc (v1.72.2) - google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Author...
  * [HIGH] CVE-2026-24051 in go.opentelemetry.io/otel/sdk (v1.36.0) - OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijackin...
  * [HIGH] CVE-2026-25681 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cr...
  * [HIGH] CVE-2026-27136 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting vi...
  * [HIGH] CVE-2026-27145 in stdlib (v1.26.3) - crypto/x509: golang: golang crypto/x509: Denial of Service via excessive proc...
  * [HIGH] CVE-2026-33814 in golang.org/x/net (v0.47.0) - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Servi...
  * [HIGH] CVE-2026-39821 in golang.org/x/net (v0.47.0) - golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege esc...
  * [HIGH] CVE-2026-39822 in stdlib (v1.26.3) - golang: Go os.Root: Symlink following vulnerability allows directory traversa...
  * [HIGH] CVE-2026-39828 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execut...
  * [HIGH] CVE-2026-39829 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via craft...
  * [HIGH] CVE-2026-39830 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resou...
  * [HIGH] CVE-2026-39831 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to...
  * [HIGH] CVE-2026-39832 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass...
  * [HIGH] CVE-2026-39835 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service v...
  * [HIGH] CVE-2026-39883 in go.opentelemetry.io/otel/sdk (v1.36.0) - github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code...
  * [HIGH] CVE-2026-42504 in stdlib (v1.26.3) - mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME hea...
  * [HIGH] CVE-2026-42508 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhost...
  * [HIGH] CVE-2026-46595 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to...
  * [HIGH] CVE-2026-46597 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via craft...
  * [HIGH] CVE-2026-56852 in golang.org/x/text (v0.31.0) - golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 inp...
  * [HIGH] GHSA-hrxh-6v49-42gf in google.golang.org/grpc (v1.72.2) - gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
  * [MEDIUM] CVE-2026-25680 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excess...
  * [MEDIUM] CVE-2026-39827 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service v...
  * [MEDIUM] CVE-2026-39833 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass...
  * [MEDIUM] CVE-2026-39834 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service d...
  * [MEDIUM] CVE-2026-42502 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting vi...
  * [MEDIUM] CVE-2026-42505 in stdlib (v1.26.3) - crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client...
  * [MEDIUM] CVE-2026-42506 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via...
  * [MEDIUM] CVE-2026-42507 in stdlib (v1.26.3) - net/textproto: golang: Golang net/textproto: Misleading error messages via in...
  * [MEDIUM] CVE-2026-46598 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial...
  * [UNKNOWN] CVE-2026-39824 in golang.org/x/sys (v0.38.0) - Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
  * [UNKNOWN] CVE-2026-46600 in golang.org/x/net (v0.47.0) - Parsing an invalid SVCB or HTTPS RR can panic when the size of a param...
 -- azcu-bot <azcu-publishing@microsoft.com>  Thu, 06 Aug 2026 00:00:00 +0000

