SUSE Azure-Storage-AzCopy Faces Multiple Security Vulnerabilities

SUSE has released an important update for azure-storage-azcopy addressing several vulnerabilities. The update includes fixes for CVE-2025-47907, CVE-2026-33186, CVE-2026-33814, CVE-2026-34986, and CVE-2026-39821. Notably, CVE-2026-33186 has a CVSS score of 9.1, indicating a high severity due to an authorization bypass vulnerability. CVE-2026-34986 allows for denial of service through crafted JWE input. Other vulnerabilities involve improper validation and infinite loops that could lead to service disruptions. The update is critical for users of azure-storage-azcopy, particularly those relying on HTTP/2 transport. Administrators are urged to apply the update to mitigate potential risks. The vulnerabilities were disclosed between 2025 and 2026, with some having public proof-of-concept code available.

Key Points: • SUSE released an important security update for azure-storage-azcopy on June 19, 2026. • Critical vulnerabilities include CVE-2026-33186 (CVSS 9.1) and CVE-2026-34986, which can lead to denial of service. • Administrators are advised to update to version 10.32.4 to address these vulnerabilities.