SUSE-SU-2026:2344-1

Details

Description of the patch:

This update for kubernetes1.28 fixes the following issues:

Security fixes:

CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265740).
CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262271).

Other fixes:

Adding Requires: diffutils dependency to Kubernetes*-client package (bsc#1251168)

Affected Packages

kubernetes1.28-client

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

1.28.13-150400.9.19.1

kubernetes1.28-client-common

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

1.28.13-150400.9.19.1

References

ADVISORY

https://bugzilla.suse.com/1251168

ADVISORY

https://bugzilla.suse.com/1262271

ADVISORY

https://bugzilla.suse.com/1265740

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2026-June/026695.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-33814/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-35469/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20262344-1/