Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
kubevirt <1.8.4-4 can let attackers smuggle requests
published 27 days ago
Summary
Versions of kubevirt older than 1.8.4-4 may mishandle certain web headers when acting as a reverse proxy, allowing a technique called response smuggling. This can let a malicious actor trick downstream web servers and bypass security checks. Upgrade kubevirt to version 1.8.4-4 or newer to close the gap.
What to do
- Update kubevirt to version 1.8.4-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | kubevirt |
< 1.8.4-4 Fix: upgrade to 1.8.4-4
|
| Azure Linux:3 | azure | kubevirt | <= 1.8.4-2 |
Original advisory text
CVE-2026-78660 affecting package kubevirt for versions less than 1.8.4-4
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
References
Timeline
Published8 Oct 2026
Updated2 Nov 2026
First seen11 Oct 2026
Sources
AZL-107673 · OSV
Track software like this
Free during beta