CVE-2026-44740

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

• [grafana / rhel-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-44740 in the rootio-github.com/go-git/go-billy/v5 package for Root:Go. Multiple fixed versions available.

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

• [grafana / almalinux-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy

These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.71.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ssm-agent-3.3.4624.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cheat-5.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267047).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265648).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266495).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266075).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).

Changes for trivy:

• Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):

• release: v0.71.0 [main] (#10638)
• ci: use only the first line of commit message in release-please workflow (#10766)
• feat: add WithDriver and WithProvider options to ospkg detector (#10740)
• chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
• refactor(secret): normalize configPath once in Init (#10702)
• feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704)
• chore(deps): bump the common group across 1 directory with 25 updates (#10758)
• chore: migrate from gomodguard to gomodguard_v2 (#10739)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)
• ci: scope GitHub App tokens to minimum required permissions (#10755)
• chore(deps): upgrade go-redis from v8 to v9 (#10736)
• fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
• fix(misconf): skip resources with no after changes (#10352)
• fix(misconf): reject nil plays during playbook parsing (#10273)
• fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
• fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
• refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
• chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
• fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
• fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions…

This update for trivy fixes the following issues

Update to version 0.71.2:

• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).
• CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268356).
• CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268440).
• CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's configuration (bsc#1268399).
• CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation (bsc#1268400).
• CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked path (bsc#1268404).
• CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration (bsc#1268403).

Changes for trivy:

• release: v0.71.2 [release/v0.71] (#10871)
• fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
• chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
• fix(oci): validate artifact filename
• fix: forward ospkg detector options through ospkg.NewScanner
• fix(vex): load VEX documents from within the repository directory
• fix: surface the original analysis error instead of context cancellation
• ci: expect GitHub App bot as backport PR author

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for alloy fixes the following issues:

Update to version 1.17.0.

Security issues fixed:

• CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service (bsc#1267185).
• CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a RangeError due to a stack overflow and cause to a denial of service (bsc#1260981).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected by the server can cause unbounded memory growth and a crash (bsc#1266196).
• CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns PartialSuccessError with non-nil permissions (bsc#1266196).
• CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).
• CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a connection's read loop and cause a resource leak (bsc#1266196).
• CVE-2026-39831: golang.org/x/crypto/ssh: missing User Presence flag checks in the Verify() method for FIDO/U2F security key types cause signatures generated without physical touch to be accepted (bsc#1266196).
• CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and allow for unrestricted use of a key on a remote host (bsc#1266196).
• CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it (bsc#1266196).
• CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single Write call on an SSH channel leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).
• CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can lead to a panic (bsc#1266196).
• CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an SQL query can lead to a SQL injection (bsc#1265440).
• CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42508: golang.org/x/crypto/ssh: revoked SignatureKeys belonging to a CA are not correctly checked for revocation (bsc#1266196).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
• CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
• CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
• CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on…

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.74.4 (boo#1267192):

  • Version v1.74.4
  • gui: update embedded release to 1.1.10
  • local: stop --links symlinks escaping the destination directory CVE-2026-54572
  • local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
  • s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
  • serve restic: fix --private-repos isolation bypass CVE-2026-59733
  • archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
  • serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
  • build: fix multiple CVEs by upgrading to go1.26.5
  • s3: fix mounting a prefix failing with 403 when HEAD is not permitted
  • drive, googlephotos: warn when using rclone's shared client_id #9580
  • drive: fix stray %!(EXTRA) in unexportable google document log message
  • serve/http: fix --disable-zip so it works over rc
  • serve webdav: fix MOVE overwrite failing without Overwrite header
  • fs: fix negative offset when a suffix Range request exceeds object size
  • accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
  • cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
  • cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
  • cmd/mount2: fix NFS file creation by implementing Mknod
  • smb: fix for IBM iSeries and signature verification
  • mega: fix hard deleted files reappearing in listings - fixes #9554
  • mega: wait for server events after upload, delete and move
  • vfs: fix hang reopening a file during the handle-caching grace period
  • s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
  • fs: fix command line flag being ignored when set to its default value
  • docs: fix copy to clipboard functionality for code blocks
  • fs/operations: correct DeleteFile --backup-dir documentation
  • build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
  • docs: clarify copyto command description - Fixes #9527
  • docs: fix typo in remote setup docs
  • serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
  • • s3: fix error mapping in GetObject to match HeadObject
  • filter: fix --files-from copy stopping at the first unreadable file
  • docs: Fix RELEASE.md
  • ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
  • completion: fix powershell completion corrupting non-ASCII names - fixes #9412
  • docs/crypt: fix encrypted size example - Fixes #9202
  • docs: drive: note Google verification exemption for personal use apps
  • rc: document that rc API access is equivalent to shell access
  • docs: drive: update documentation about "Computers" folder
  • accounting: fix goroutine leak in ResetCounters
  • docs: fix --windows-event-log-level help
  • backend/filelu: fix recursive listing path handling and file filtering
  • docs: bisync - clarify flag interaction and minor changes
  • docs: Update RELEASE.md to use cherry-pick -x
  • webdav: fix mixed property statuses in multi-status responses
  • s3: remove session token on cross-host redirects
  • drive: warn when non-exportable Google documents are skipped - #9475
  • Start v1.74.4-DEV development

• update x/image to 0.43 (bsc#1271056)

• Update to version 1.74.3: (boo#1267869)

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
• GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
• GO-2026-5048 GHSA-mx64-mj3q-7prj
• GO-2026-5051
• GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
• GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
• GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
• GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
• GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
• GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
• GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
• GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
• GO-2026-5309 GHSA-c3wq-j5vh-68rc
• GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
• GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
• GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
• GO-2026-5408 GHSA-gx7w-56w6-g48x
• GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
• GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
• GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
• GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
• GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
• GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
• GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
• GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
• GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
• GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
• GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
• GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
• GO-2026-5569 GHSA-q76j-gcg9-vxc6
• GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
• GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
• GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
• GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
• GO-2026-5606 GHSA-r46f-3rpw-hxrv
• GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
• GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
• GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
• GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
• GO-2026-5693 GHSA-w5pp-99ch-qj29
• GO-2026-5730 GHSA-wwhq-w58m-w29c
• GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
• GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
• GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
• GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
• GO-2026-5774 GHSA-3fxj-6jh8-hvhx
• GO-2026-5775 GHSA-9g5q-2w5x-hmxf
• GO-2026-5777 GHSA-rjr7-jggh-pgcp
• GO-2026-5781
• GO-2026-5841 GHSA-259r-337f-4rfw
• GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
• GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
• GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
• GO-2026-5884 GHSA-vh4v-2xq2-g5cg
• GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
• GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
• GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
• GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
• GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
• GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
• GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
• GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
• GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
• GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
• GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
• GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
• GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
• GO-2026-6061 GHSA-hrxh-6v49-42gf
• GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
• GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
• GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
• GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
• GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
• GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
• GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
• GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
• GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
• GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
• GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
• GO-2026-6073 CVE-2026-58435…

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for alloy fixes the following issues:

Update to version 1.17.0.

Security issues fixed:

• CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service (bsc#1267185).
• CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a RangeError due to a stack overflow and cause to a denial of service (bsc#1260981).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected by the server can cause unbounded memory growth and a crash (bsc#1266196).
• CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns PartialSuccessError with non-nil permissions (bsc#1266196).
• CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).
• CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a connection's read loop and cause a resource leak (bsc#1266196).
• CVE-2026-39831: golang.org/x/crypto/ssh: missing User Presence flag checks in the Verify() method for FIDO/U2F security key types cause signatures generated without physical touch to be accepted (bsc#1266196).
• CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and allow for unrestricted use of a key on a remote host (bsc#1266196).
• CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it (bsc#1266196).
• CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single Write call on an SSH channel leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).
• CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can lead to a panic (bsc#1266196).
• CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an SQL query can lead to a SQL injection (bsc#1265440).
• CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42508: golang.org/x/crypto/ssh: revoked SignatureKeys belonging to a CA are not correctly checked for revocation (bsc#1266196).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
• CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
• CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
• CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
• GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
• GO-2026-5048 GHSA-mx64-mj3q-7prj
• GO-2026-5051
• GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
• GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
• GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
• GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
• GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
• GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
• GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
• GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
• GO-2026-5309 GHSA-c3wq-j5vh-68rc
• GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
• GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
• GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
• GO-2026-5408 GHSA-gx7w-56w6-g48x
• GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
• GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
• GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
• GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
• GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
• GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
• GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
• GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
• GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
• GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
• GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
• GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
• GO-2026-5569 GHSA-q76j-gcg9-vxc6
• GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
• GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
• GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
• GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
• GO-2026-5606 GHSA-r46f-3rpw-hxrv
• GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
• GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
• GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
• GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
• GO-2026-5693 GHSA-w5pp-99ch-qj29
• GO-2026-5730 GHSA-wwhq-w58m-w29c
• GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
• GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
• GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
• GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
• GO-2026-5774 GHSA-3fxj-6jh8-hvhx
• GO-2026-5775 GHSA-9g5q-2w5x-hmxf
• GO-2026-5777 GHSA-rjr7-jggh-pgcp
• GO-2026-5781
• GO-2026-5841 GHSA-259r-337f-4rfw
• GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
• GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
• GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
• GO-2026-5884 GHSA-vh4v-2xq2-g5cg
• GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
• GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
• GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
• GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
• GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
• GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
• GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
• GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
• GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
• GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
• GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
• GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
• GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
• GO-2026-6061 GHSA-hrxh-6v49-42gf
• GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
• GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
• GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
• GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
• GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
• GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
• GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
• GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
• GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
• GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
• GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
• GO-2026-6073 CVE-2026-58435…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
• GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
• GO-2026-5048 GHSA-mx64-mj3q-7prj
• GO-2026-5051
• GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
• GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
• GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
• GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
• GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
• GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
• GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
• GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
• GO-2026-5309 GHSA-c3wq-j5vh-68rc
• GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
• GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
• GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
• GO-2026-5408 GHSA-gx7w-56w6-g48x
• GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
• GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
• GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
• GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
• GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
• GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
• GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
• GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
• GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
• GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
• GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
• GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
• GO-2026-5569 GHSA-q76j-gcg9-vxc6
• GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
• GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
• GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
• GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
• GO-2026-5606 GHSA-r46f-3rpw-hxrv
• GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
• GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
• GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
• GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
• GO-2026-5693 GHSA-w5pp-99ch-qj29
• GO-2026-5730 GHSA-wwhq-w58m-w29c
• GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
• GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
• GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
• GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
• GO-2026-5774 GHSA-3fxj-6jh8-hvhx
• GO-2026-5775 GHSA-9g5q-2w5x-hmxf
• GO-2026-5777 GHSA-rjr7-jggh-pgcp
• GO-2026-5781
• GO-2026-5841 GHSA-259r-337f-4rfw
• GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
• GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
• GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
• GO-2026-5884 GHSA-vh4v-2xq2-g5cg
• GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
• GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
• GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
• GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
• GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
• GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
• GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
• GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
• GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
• GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
• GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
• GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
• GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
• GO-2026-6061 GHSA-hrxh-6v49-42gf
• GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
• GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
• GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
• GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
• GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
• GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
• GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
• GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
• GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
• GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
• GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
• GO-2026-6073 CVE-2026-58435…

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for alloy fixes the following issues

• CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing malformed ELF/BTF input (bsc#1267811).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267185).
• CVE-2026-33532: Denial of Service via deeply nested YAML document parsing (bsc#1260981).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1266196).
• CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: SQL injection when placeholders in dollar-quoted string literals are used in the SQL query (bsc#1265440).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
• CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
• CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
• CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes a DoS (bsc#1267488).
• CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash the OBI process and cause denial of service (bsc#1267489).

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
• CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
• CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
• CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
• CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:

Security issues fixed:

• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278462 bsc#1278477 bsc#1278505).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276980).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276990).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278269 bsc#1279243 bsc#1279245 bsc#1279252 bsc#1279263 bsc#1279386).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278272 bsc#1279072 bsc#1279080 bsc#1279137).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278742 bsc#1278743 bsc#1278751 bsc#1278763).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1278267).

Non security issue fixed:

• terraform-provider-{aws,external,google,random,tls}: aarch64 build installs provider binary under linux_amd64 instead of linux_arm64, breaking terraform init (bsc#1280175).