gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

• azl3 azcopy 10.25.1-8 on Azure Linux 3.0

• azl3 azurelinux-image-tools 1.6.0-2 on Azure Linux 3.0

• azl3 cert-manager 1.12.15-12 on Azure Linux 3.0

• azl3 cf-cli 8.7.11-8 on Azure Linux 3.0

• azl3 cloud-provider-kubevirt 0.5.1-7 on Azure Linux 3.0

• azl3 containerd2 2.2.4-8 on Azure Linux 3.0

• azl3 containerized-data-importer 1.62.0-7 on Azure Linux 3.0

• azl3 coredns 1.11.4-20 on Azure Linux 3.0

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Nov 4, 2026 at 12:10 PM UTC
   • Removed affected products: azl3 kubevirt-openvmm 1.9.0-1 on Azure Linux 3.0.
2. Nov 2, 2026 at 11:30 AM UTC
   • Added affected products: azl3 cri-tools 1.32.0-10 on Azure Linux 3.0, azl3 docker-buildx 0.14.0-19 on Azure Linux 3.0, azl3 moby-containerd-cc 1.7.7-19 on Azure Linux 3.0, azl3 multus 4.0.2-12 on Azure Linux 3.0, azl3 packer 1.9.5-23 on Azure....
   • Added fixed versions: 2.3.7-1.
   • Removed fixed versions: 2.4.0-1.
3. Oct 31, 2026 at 10:50 AM UTC
   • Added affected products: azl3 kubevirt-openvmm 1.9.0-1 on Azure Linux 3.0.
4. Oct 16, 2026 at 11:45 AM UTC
   • Removed affected products: azl3 cf-cli 8.7.11-9 on Azure Linux 3.0.
5. Oct 10, 2026 at 9:45 AM UTC
   • The vendor changed the advisory's last-updated date.
6. Oct 8, 2026 at 9:05 AM UTC
   • Added fixed versions: 0.12.0-11, 0.24.2-33, 1.8.4-3, 1.30.10-31, 2.4.0-1.
7. Oct 7, 2026 at 8:15 AM UTC
   • The vendor changed the advisory's last-updated date.
8. Oct 6, 2026 at 7:55 AM UTC
   • Added fixed versions: 3.5.34-1.
9. Sep 27, 2026 at 11:11 PM UTC
   • Added affected products: azl3 cf-cli 8.7.11-9 on Azure Linux 3.0, azl3 containerd2 2.3.4-1 on Azure Linux 3.0, azl3 cri-tools 1.32.0-8 on Azure Linux 3.0, azl3 docker-buildx 0.14.0-17 on Azure Linux 3.0, azl3 docker-compose 2.27.0-14 on Azure....
   • Removed affected products: azl3 docker-cli 25.0.7-5 on Azure Linux 3.0, azl3 ignition-flatcar 2.22.0-6 on Azure Linux 3.0, azl3 opa 0.63.0-5 on Azure Linux 3.0.
   • Added fixed versions: 0.0.10-10, 0.5.1-9, 1.6.0-3, 1.11.4-21, 1.12.15-14.
   • The vendor changed its remediation guidance.

1. Sep 16, 2026 at 1:05 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Sep 17, 2026 at 10:05 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

3. Nov 4, 2026 at 1:46 AM UTC
   Updated by Microsoft Security Response Center

   The vendor changed the advisory after it was first published.

4. Nov 10, 2026 at 2:00 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.