CVE-2026-116586Medium

Microsoft security update for CVE-2026-116586

Published
October 31, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-116586 →

📋 Microsoft's advisory

EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116586. This page also shows what EchelonGraph holds for CVE-2026-116586, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.

🎯 Affected products31

  • azl3 azcopy 10.25.1-10 on Azure Linux 3.0
  • azl3 cert-manager 1.12.15-15 on Azure Linux 3.0
  • azl3 containerd2 2.3.7-1 on Azure Linux 3.0
  • azl3 containerized-data-importer 1.62.0-10 on Azure Linux 3.0
  • azl3 containerized-data-importer 1.62.0-9 on Azure Linux 3.0
  • azl3 dcos-cli 1.2.0-22 on Azure Linux 3.0
  • azl3 dcos-cli 1.2.0-23 on Azure Linux 3.0
  • azl3 ignition-flatcar 2.22.0-6 on Azure Linux 3.0
  • azl3 ignition-flatcar 2.22.0-7 on Azure Linux 3.0
  • azl3 influxdb 2.7.5-22 on Azure Linux 3.0
  • azl3 influxdb 2.7.5-23 on Azure Linux 3.0
  • azl3 influxdb 2.7.5-24 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-32 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-33 on Azure Linux 3.0
  • azl3 moby-containerd-cc 1.7.7-19 on Azure Linux 3.0
  • azl3 packer 1.9.5-23 on Azure Linux 3.0
  • azl3 packer 1.9.5-24 on Azure Linux 3.0
  • azl3 skopeo 1.14.4-15 on Azure Linux 3.0
  • azl3 skopeo 1.14.4-16 on Azure Linux 3.0
  • azl3 telegraf 1.31.0-35 on Azure Linux 3.0
  • azl3 telegraf 1.31.0-36 on Azure Linux 3.0
  • azl3 telegraf 1.31.0-38 on Azure Linux 3.0
  • azl3 vitess 19.0.4-16 on Azure Linux 3.0
  • azl4 buildah 2:1.43.4-2.azl4 on Azure Linux 4.0
  • azl4 cri-o 1.32.0-7.azl4 on Azure Linux 4.0
  • azl4 image-builder 84.0.0-5.azl4 on Azure Linux 4.0
  • azl4 moby-engine 29.7.2-2.azl4 on Azure Linux 4.0
  • azl4 osbuild-composer 176-5.azl4 on Azure Linux 4.0
  • azl4 skopeo 1:1.22.3-2.azl4 on Azure Linux 4.0
  • azl4 telegraf 1.38.2-5.azl4 on Azure Linux 4.0
  • +1 more not shown

✅ Updates Microsoft lists: 7 updates

7 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.

KB articleUpdateFixed build
—Security Update—
—Security Update1.31.0-37
—Security Update1.62.0-10
—Security Update1.30.10-33
—Security Update1.14.4-16
—Security Update1.2.0-23
—Security Update1.31.0-38

🧭 EchelonGraph on CVE-2026-116586

EchelonGraph score
6.9 MEDIUM
CISA KEV
Not listed
Fix status
A fix is available — apply it.

Description from the CVE record (CVE.org), as published by its numbering authority

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.

Published by GitHub, Inc., the CVE Numbering Authority that assigned CVE-2026-116586, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).

🔗 References (2)