Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
kubevirt may run out of memory from crafted Trailer headers
published 27 days ago
Summary
Versions of kubevirt older than 1.8.4-4 can be forced to use a large amount of memory when a client sends many special "Trailer" headers over a modern web connection. This can slow down or stop the service. Upgrade kubevirt to version 1.8.4-4 or later, or apply the vendor’s patch, to stop the problem.
What to do
- Update kubevirt to version 1.8.4-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | kubevirt |
< 1.8.4-4 Fix: upgrade to 1.8.4-4
|
| Azure Linux:3 | azure | kubevirt | <= 1.8.4-2 |
Original advisory text
CVE-2026-78659 affecting package kubevirt for versions less than 1.8.4-4
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
References
Timeline
Published8 Oct 2026
Updated2 Nov 2026
First seen11 Oct 2026
Sources
AZL-107670 · OSV
Track software like this
Free during beta