gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

• azl3 docker-cli 25.0.7-4 on Azure Linux 3.0

• azl3 flannel 0.24.2-29 on Azure Linux 3.0

• azl3 kubevirt 1.7.1-8 on Azure Linux 3.0

• azl3 multus 4.0.2-10 on Azure Linux 3.0

• azl3 packer 1.9.5-18 on Azure Linux 3.0

• azl3 prometheus-adapter 0.12.0-7 on Azure Linux 3.0

• azl3 vitess 19.0.4-12 on Azure Linux 3.0

• azl3 containerd2 2.2.4-8 on Azure Linux 3.0

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Oct 10, 2026 at 9:45 AM UTC
   • The vendor changed the advisory's last-updated date.
2. Oct 8, 2026 at 9:05 AM UTC
   • Added fixed versions: 0.14.0-18, 0.24.2-33, 1.7.7-18, 1.8.4-3, 1.9.5-22.
3. Oct 7, 2026 at 8:15 AM UTC
   • The vendor changed the advisory's last-updated date.
4. Oct 6, 2026 at 7:55 AM UTC
   • Added fixed versions: 3.5.34-1.
5. Sep 27, 2026 at 11:11 PM UTC
   • Severity changed from High to Medium.
   • Added affected products: azl3 containerd2 2.3.4-1 on Azure Linux 3.0, azl3 cri-tools 1.32.0-8 on Azure Linux 3.0, azl3 docker-buildx 0.14.0-17 on Azure Linux 3.0, azl3 docker-compose 2.27.0-14 on Azure Linux 3.0, azl3 flannel 0.24.2-32 on Azure....
   • Added fixed versions: 1.6.0-3, 1.11.4-21, 1.14.4-13, 1.31.0-33, 1.62.0-8.
   • The vendor changed its remediation guidance.
6. Sep 15, 2026 at 9:25 AM UTC
   • Removed affected products: azl3 cert-manager 1.12.15-12 on Azure Linux 3.0, azl3 cf-cli 8.7.11-8 on Azure Linux 3.0, azl3 cloud-provider-kubevirt 0.5.1-7 on Azure Linux 3.0, azl3 docker-cli 25.0.7-5 on Azure Linux 3.0, azl3 ignition-flatcar....
7. Sep 10, 2026 at 7:45 AM UTC
   • CVSS changed from not listed to 7.5.
   • Added affected products: azl3 azcopy 10.25.1-8 on Azure Linux 3.0, azl3 azurelinux-image-tools 1.6.0-2 on Azure Linux 3.0, azl3 cert-manager 1.12.15-12 on Azure Linux 3.0, azl3 cloud-provider-kubevirt 0.5.1-7 on Azure Linux 3.0, azl3 containerd2....
8. Sep 9, 2026 at 7:25 AM UTC
   • Removed affected products: azl3 grpc 1.62.3-1 on Azure Linux 3.0, azl3 libcontainers-common 20240213-3 on Azure Linux 3.0.
9. Sep 8, 2026 at 7:05 AM UTC
   • Added affected products: azl3 grpc 1.62.3-1 on Azure Linux 3.0.

1. Sep 5, 2026 at 1:37 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Sep 6, 2026 at 12:30 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

3. Oct 10, 2026 at 1:49 AM UTC
   Updated by Microsoft Security Response Center

   The vendor changed the advisory after it was first published.

4. Oct 28, 2026 at 3:45 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.