Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Kata Containers preview can be tricked to exceed data limits
published 27 days ago
Summary
The preview version of Kata Containers can mistakenly count incoming data twice when a client resets a stream, allowing a malicious client to send more data than the configured connection limit. This could lead to resource exhaustion or degraded performance. Apply the vendor’s updated package or any provided mitigation as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kata-containers-preview | <= 3.27.0~preview2-2 |
Original advisory text
CVE-2026-78663 affecting package kata-containers-preview 3.27.0~preview2-2
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
References
Timeline
Published8 Oct 2026
Updated11 Oct 2026
First seen11 Oct 2026
Sources
AZL-107093 · OSV
Track software like this
Free during beta