kubelet (1.35.6-debian12u7) bookworm; urgency=low

  * [CRITICAL] CVE-2026-33186 in google.golang.org/grpc (v1.72.2) - google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  * [HIGH] CVE-2026-24051 in go.opentelemetry.io/otel/sdk (v1.36.0) - OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
  * [HIGH] CVE-2026-25681 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
  * [HIGH] CVE-2026-27136 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
  * [HIGH] CVE-2026-33814 in golang.org/x/net (v0.47.0) - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
  * [HIGH] CVE-2026-39821 in golang.org/x/net (v0.47.0) - golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
  * [HIGH] CVE-2026-39828 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  * [HIGH] CVE-2026-39829 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  * [HIGH] CVE-2026-39830 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  * [HIGH] CVE-2026-39831 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
  * [HIGH] CVE-2026-39832 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
  * [HIGH] CVE-2026-39835 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
  * [HIGH] CVE-2026-39883 in go.opentelemetry.io/otel/sdk (v1.36.0) - github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris
  * [HIGH] CVE-2026-42508 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
  * [HIGH] CVE-2026-46595 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
  * [HIGH] CVE-2026-46597 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
  * [MEDIUM] CVE-2026-25680 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
  * [MEDIUM] CVE-2026-39827 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
  * [MEDIUM] CVE-2026-39833 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
  * [MEDIUM] CVE-2026-39834 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
  * [MEDIUM] CVE-2026-42502 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
  * [MEDIUM] CVE-2026-42506 in golang.org/x/net (v0.47.0) - golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
  * [MEDIUM] CVE-2026-46598 in golang.org/x/crypto (v0.45.0) - golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
  * [UNKNOWN] CVE-2026-39824 in golang.org/x/sys (v0.38.0) - Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
 -- azcu-bot <azcu-publishing@microsoft.com>  Fri, 10 Jul 2026 00:00:00 +0000

