{
  "cveId": "CVE-2026-13201",
  "url": "https://patchblox.com/security/cve/CVE-2026-13201",
  "summary": "CVE-2026-13201 is fixed in 3 products on 1 platform, first by SUSE-SU-2026:3480-1, released August 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "kubevirt: This update for kubevirt fixes the following issues:\n\n- Security update correcting a CVE over-claim from the previous...",
  "description": "This update for kubevirt fixes the following issues:\n\n- Security update correcting a CVE over-claim from the previous\n  update, verified by auditing the fix code actually present in the\n  vendored tree:\n\n  * CVE-2026-39821 (bsc#1266575): the previous entry claimed this\n    fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0\u0027s\n    idna fix is compile-time gated on Unicode 16 tables, which only\n    exist for go1.27\u002B - it is inert in our go1.25 builds, so the\n    claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -\u003E\n    v0.57.0, whose idna package rejects all-ASCII Punycode labels\n    unconditionally; the CVE is now actually fixed.\n\n- Re-vendor golang.org/x/text v0.37.0 -\u003E v0.40.0: CVE-2026-56852\n  (bsc#1271661), infinite loop on invalid input in unicode/norm.\n\n- golang.org/x/crypto v0.52.0 -\u003E v0.54.0 (pulled in by x/net 0.57.0;\n  no additional CVE claims, all previously listed x/crypto fixes\n  remain included).\n\n- CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last\n  component is a symlink without detecting it, allowing metadata\n  operations via /proc/self/fd to act on the symlink target.\n  Backports of upstream release-1.7 commits 9ecda4ad5e and\n  1494cee849.\n- x/net 0.57.0 also contains the fix for CVE-2026-46600\n  (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that\n  package (not affected), the bump merely rides past it.",
  "published": "2026-08-04T11:42:30Z",
  "severity": "",
  "epss": 0.00308,
  "epssPercentile": 0.23799,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "kubevirt",
      "release": "sles 15.7",
      "fixedVersion": "1.7.4-150700.3.33.1",
      "fix": "SUSE-SU-2026:3480-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3480-1",
      "released": "2026-08-04T11:42:30Z"
    },
    {
      "platform": "linux",
      "product": "kubevirt-1.6",
      "release": "sles 15.7",
      "fixedVersion": "1.6.6-150700.15.17.1",
      "fix": "SUSE-SU-2026:3630-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3630-1",
      "released": "2026-08-17T16:50:34Z"
    },
    {
      "platform": "linux",
      "product": "kubevirt1.8",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.8.4-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21590-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21590-1",
      "released": "2026-08-18T16:05:12Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}