Msrc Cbl2 Tensorflow 2.11.1-2 On Cbl Mariner 2.0 vulnerabilities

CVE-2026-27142 [MEDIUM] URLs in meta content attribute actions are not escaped in html/template URLs in meta content attribute actions are not escaped in html/template Mariner: Mariner Go: Go Customer Action Required: Yes

CVE-2026-3338 [HIGH] CWE-347 PKCS7_verify Signature Validation Bypass in AWS-LC PKCS7_verify Signature Validation Bypass in AWS-LC Mariner: Mariner AMZN: AMZN Customer Action Required: Yes

CVE-2026-3336 [HIGH] CWE-295 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC PKCS7_verify Certificate Chain Validation Bypass in AWS-LC Mariner: Mariner AMZN: AMZN Customer Action Required: Yes

CVE-2026-23868 [MEDIUM] CVE-2026-23868: Mariner: Mariner Meta: Meta Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn Mariner: Mariner Meta: Meta Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2026-3784 [MEDIUM] wrong proxy connection reuse with credentials wrong proxy connection reuse with credentials Mariner: Mariner curl: curl Customer Action Required: Yes

CVE-2026-1965 [MEDIUM] bad reuse of HTTP Negotiate connection bad reuse of HTTP Negotiate connection Mariner: Mariner curl: curl Customer Action Required: Yes

CVE-2026-3713 [MEDIUM] CWE-122 pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow Mariner: Mariner VulDB: VulDB Customer Action Required: Yes

CVE-2026-3783 [MEDIUM] token leak with redirect and netrc token leak with redirect and netrc Mariner: Mariner curl: curl Customer Action Required: Yes

CVE-2026-2492 [HIGH] CWE-427 TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability Mariner: Mariner zdi: zdi Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-66293 [HIGH] CWE-125 LIBPNG has an out-of-bounds read in png_image_read_composite LIBPNG has an out-of-bounds read in png_image_read_composite Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-34297 [HIGH] CWE-190 KissFFT Integer Overflow Heap Buffer Overflow via kiss_fft_alloc KissFFT Integer Overflow Heap Buffer Overflow via kiss_fft_alloc Mariner: Mariner VulnCheck: VulnCheck Customer Action Required: Yes

CVE-2025-61727 [MEDIUM] Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 Mariner: Mariner Go: Go Customer Action Required: Yes

CVE-2025-64720 [HIGH] CWE-125 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-65018 [HIGH] CWE-787 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-64505 [MEDIUM] CWE-125 LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-64506 [MEDIUM] CWE-125 LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images LIBPNG is vulnerable to a heap buffer over-read in `png_write_image_8bit` with grayscale+alpha or RGB/RGBA images Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-10966 [MEDIUM] missing SFTP host verification with wolfSSH missing SFTP host verification with wolfSSH Mariner: Mariner curl: curl Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade

CVE-2025-47912 [MEDIUM] Insufficient validation of bracketed IPv6 hostnames in net/url Insufficient validation of bracketed IPv6 hostnames in net/url FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with

CVE-2025-58189 [MEDIUM] ALPN negotiation error contains attacker controlled information in crypto/tls ALPN negotiation error contains attacker controlled information in crypto/tls FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of

CVE-2025-58185 [MEDIUM] Parsing DER payload can cause memory exhaustion in encoding/asn1 Parsing DER payload can cause memory exhaustion in encoding/asn1 FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries