SUSE-SU-2026:2342-1

Details

Description of the patch:

This update for kubernetes fixes the following issues

CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265748).
CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262270).

Changes for kubernetes:

Update to version 1.35.4:

Affected Packages

kubernetes1.35-client

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Containers 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

1.35.4-150600.13.34.1

kubernetes1.35-client-bash-completion

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Containers 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

1.35.4-150600.13.34.1

kubernetes1.35-client-common

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Containers 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

1.35.4-150600.13.34.1

References

ADVISORY

https://bugzilla.suse.com/1262270

ADVISORY

https://bugzilla.suse.com/1265748

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2026-June/026697.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-33814/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-35469/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20262342-1/