Critical Denial of Service Vulnerabilities in openSUSE Kubernetes

Recent updates for openSUSE Kubernetes have addressed significant denial of service vulnerabilities, specifically CVE-2026-33814 and CVE-2026-35469. CVE-2026-33814, published on May 7, 2026, involves an infinite loop in HTTP/2 transport when bad SETTINGS_MAX_FRAME_SIZE is provided. CVE-2026-35469, published on April 16, 2026, relates to memory amplification in SPDY frame parsing, leading to potential denial of service. Affected versions include Kubernetes 1.23 through 1.28, with patches available for various openSUSE and SUSE Linux Enterprise products. The vulnerabilities pose a risk of service disruption for users running these Kubernetes versions. Administrators are advised to apply the latest patches immediately to mitigate risks. The updates were released on June 10, 2026, and are deemed important by SUSE.

Key Points: • Critical denial of service vulnerabilities identified in openSUSE Kubernetes versions 1.23 to 1.28. • CVE-2026-33814 and CVE-2026-35469 are the primary vulnerabilities addressed in recent patches. • Administrators are urged to apply patches immediately to prevent potential service disruptions.