VulnerableCode Package Details - pkg:rpm/redhat/kubevirt@4.13.6-1596?arch=el7

Search for packages

Vulnerability	Summary	Fixed by
VCID-5781-s1ny-q7ey Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p GMS-2023-3377 VSV00013		There are no reported fixed by versions.
VCID-h7qt-3g1f-5ffr Aliases: CVE-2023-39325 GHSA-4374-p667-p6c8	HTTP/2 rapid reset can cause excessive work in net/http A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-5781-s1ny-q7ey
Aliases:
CVE-2023-44487
GHSA-2m7v-gc89-fjqf
GHSA-qppj-fm5r-hxr3
GHSA-vx74-f528-fxqg
GHSA-xpw8-rcwv-8f8p
GMS-2023-3377
VSV00013

There are no reported fixed by versions.

VCID-h7qt-3g1f-5ffr
Aliases:
CVE-2023-39325
GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T13:39:37.598324+00:00	RedHat Importer	Affected by	VCID-h7qt-3g1f-5ffr	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39325.json	38.4.0
2026-04-01T13:52:14.863885+00:00	RedHat Importer	Affected by	VCID-h7qt-3g1f-5ffr	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-39325.json	38.0.0
2026-04-01T13:51:41.895082+00:00	RedHat Importer	Affected by	VCID-5781-s1ny-q7ey	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44487.json	38.0.0