SUSE Azure-Storage-AzCopy Important Denial of Service Vuln 2026-2466

Back Linuxsecurity

SUSE Azure-Storage-AzCopy Important Denial of Service Vuln 2026-2466

Linuxsecurity •LinuxSecurity Advisories • June 19, 2026

Share: View original

## This update for azure-storage-azcopy fixes the following issues Update to 10.32.4: * CVE-2025-47907: database/sql: incorrect results returned from Rows.Scan (bsc#1247720). * CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260307). * CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265841). * CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262962). * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266657). Changes:

## This update for azure-storage-azcopy fixes the following issues Update to 10.32.4: * CVE-2025-47907: database/sql: incorrect results returned from Rows.Scan (bsc#1247720). * CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260307). * CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265841). * CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262962). * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266657). Changes:

* CVE-2025-47907 ( SUSE ): 2.1

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

* CVE-2025-47907 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

* CVE-2025-47907 ( NVD ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

* CVE-2026-33186 ( SUSE ): 8.6

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

* CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

* CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

* CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Announcement ID: SUSE-SU-2026:2466-1 Release Date: 2026-06-19T11:02:49Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Azure-Storage-AzCopy Faces Multiple Security Vulnerabilities SUSE has released an important update for azure-storage-azcopy addressing several vulnerabilities. The update includes fixes for CVE-2025-47907, CVE-2026-33186, CVE-2026-33814, CVE-2026-34986, and CVE-2026-39821. Notably, CVE-2026-33186 has a CVSS score of 9.1, indicating a high severity due to an authorization bypass vulnerability. CVE-2026-34986 allows for denial of service through crafted JWE input. Other vulnerabilities involve improper validation and infinite loops that could lead to service disruptions. The update is critical for users of azure-storage-azcopy, particularly those relying on HTTP/2 transport. Administrators are urged to apply the update to mitigate potential risks. The vulnerabilities were disclosed between 2025 and 2026, with some having public proof-of-concept code available. 2 sources 71

Extracted Entities

Attack Types (1)

Denial of Service

Companies (1)

CVEs (5)

CVE-2025-47907 CVE-2026-33186 CVE-2026-33814 CVE-2026-34986 CVE-2026-39821

Domains (2)

golang.org google.golang.org

Platforms (1)