kubelet (1.36.3-ubuntu22.04u4) jammy; urgency=low

  * [HIGH] CVE-2026-25681 in golang.org/x/net (v0.49.0) - golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cr...
  * [HIGH] CVE-2026-27136 in golang.org/x/net (v0.49.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting vi...
  * [HIGH] CVE-2026-33814 in golang.org/x/net (v0.49.0) - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Servi...
  * [HIGH] CVE-2026-39821 in golang.org/x/net (v0.49.0) - golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege esc...
  * [HIGH] CVE-2026-39828 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execut...
  * [HIGH] CVE-2026-39829 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via craft...
  * [HIGH] CVE-2026-39830 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resou...
  * [HIGH] CVE-2026-39831 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to...
  * [HIGH] CVE-2026-39832 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass...
  * [HIGH] CVE-2026-39835 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service v...
  * [HIGH] CVE-2026-39883 in go.opentelemetry.io/otel/sdk (v1.40.0) - github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code...
  * [HIGH] CVE-2026-42508 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhost...
  * [HIGH] CVE-2026-46595 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to...
  * [HIGH] CVE-2026-46597 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via craft...
  * [HIGH] CVE-2026-56852 in golang.org/x/text (v0.33.0) - golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 inp...
  * [HIGH] GHSA-hrxh-6v49-42gf in google.golang.org/grpc (v1.79.3) - gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
  * [MEDIUM] CVE-2026-25680 in golang.org/x/net (v0.49.0) - golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excess...
  * [MEDIUM] CVE-2026-39827 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service v...
  * [MEDIUM] CVE-2026-39833 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass...
  * [MEDIUM] CVE-2026-39834 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service d...
  * [MEDIUM] CVE-2026-42502 in golang.org/x/net (v0.49.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting vi...
  * [MEDIUM] CVE-2026-42506 in golang.org/x/net (v0.49.0) - golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via...
  * [MEDIUM] CVE-2026-46598 in golang.org/x/crypto (v0.47.0) - golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial...
  * [MEDIUM] GHSA-gcjh-h69q-9w9g in github.com/google/cel-go (v0.26.0) - cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag
  * [UNKNOWN] CVE-2026-39824 in golang.org/x/sys (v0.40.0) - Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
  * [UNKNOWN] CVE-2026-46600 in golang.org/x/net (v0.49.0) - Parsing an invalid SVCB or HTTPS RR can panic when the size of a param...
 -- azcu-bot <azcu-publishing@microsoft.com>  Thu, 06 Aug 2026 00:00:00 +0000

