Every CVE Search/ Get API key

CVE-2026-10722

cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow

4.8 MediumFix available

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.18%Up 0.2 points since Jun 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
CVE-2026-10722
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-190, CWE-189
Updated
2026-11-02
EUVDEUVD-2026-34082 4.8

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
EUVD-2026-34082
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-xhgw-qwwf-pg32 1.9

ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
GHSA-xhgw-qwwf-pg32
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 1.9

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
CVE-2026-10722
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-189, CWE-190
Updated
2026-11-02
OSV 1.9

cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
CVE-2026-10722
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-189, CWE-190
Updated
2026-11-02
OSVDEBIAN-CVE-2026-10722 5.5

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
DEBIAN-CVE-2026-10722
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 23 moreShow less
OSVGHSA-xhgw-qwwf-pg32 1.9

ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
GHSA-xhgw-qwwf-pg32
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
OSVUBUNTU-CVE-2026-10722 1.9

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
UBUNTU-CVE-2026-10722
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-111653 No score

CVE-2026-10722 affecting package kubevirt-openvmm 1.9.0-1

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
AZL-111653
Updated
2026-11-05
OSVAZL-89390 No score

CVE-2026-10722 affecting package cri-o 1.30.1-1

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
AZL-89390
Updated
2026-11-05
OSVAZL-89393 No score

CVE-2026-10722 affecting package kata-containers-preview 3.27.0~preview2-2

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Record
AZL-89393
Updated
2026-11-05
OSVGO-2026-6238 No score

Integer overflow in BTF parsing in github.com/cilium/ebpf

Integer overflow in BTF parsing in github.com/cilium/ebpf

Record
GO-2026-6238
Updated
2026-11-02
OSVopenSUSE-SU-2026:11153-1 No score

cadvisor-0.60.3-1.1 on GA media

These are all security issues fixed in the cadvisor-0.60.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11153-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11165-1 No score

alloy-1.17.1-1.1 on GA media

These are all security issues fixed in the alloy-1.17.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11165-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11443-1 No score

amazon-ecs-init-1.106.0-1.1 on GA media

These are all security issues fixed in the amazon-ecs-init-1.106.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11443-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21265-1 No score

Security update for cadvisor

This update for cadvisor fixes the following issues:

Changes in cadvisor:

  • update to 0.60.3:

    • Move OOM watching out of the lib module into the binary
    • lib/model: make ContainerStats sub-stats pointers to convey collection presence

  • update to 0.60.1:

    • cpuload/netlink: report the real error and skip the reader on cgroup v2
    • deploy: add lib/go.mod to the image build's dependency cache

  • update to 0.60.0:

    • Exposing additional cgroup v2 memory.stat metrics
    • lib: introduce github.com/google/cadvisor/lib — a lean, kubelet-focused library module

  • bump x/net to 0.55 (bsc#1266645, CVE-2026-39821)

  • update to 0.57.0 (bsc#1260305, CVE-2026-33186):

    • integration: add more Docker container handler tests
    • integration: add containerd container handler tests
    • integration: add Prometheus metrics endpoint tests
    • fix: support podman volatile-containers.json and/or containers.json
    • proposed roadmap for cAdvisor
    • remove log message when you can't read productName
    • Refactor Github Action per b/485167538
    • fix crio deadlock in getting crio sandbox containers
    • Add container_creation_time_seconds (previously: container_start_time_seconds); use runtime start time for container_start_time_seconds (podman & docker)
    • deps: github.com/moby/moby/client v0.4.0, moby/api v1.54.1, containerd/ttrpc v1.2.8
    • fix(build): update k8s-staging-test-infra image in integ tests
    • feat(manager/container): add configurable initial splay and max jitter factors
    • feat(manager): add constraint data in OOM events
    • fix: add v-prefixed GHCR image tags for release consistency
    • build(deps): bump the go_modules group across 2 directories with 1 update
    • Expose cgroup v2 memory.events as Prometheus metrics
    • deploy: bump base images to Alpine 3.23

  • Update to version 0.56.2:

    • docker: fix nil pointer dereference when GraphDriver is nil
    • Update healthcheck.sh
    • Update entrypoint.sh
    • docker: migrate to github.com/moby/moby modules
    • Update containerd, docker, moby, and opencontainers dependencies
    • update README
    • Update copyright year in healthcheck.sh
    • Update copyright year in entrypoint.sh
    • Added cadvisor boilerplate header to deploy/entrypoint.sh
    • Added cadvisor boilerplate header to deploy/healthcheck.sh
    • Add EXPOSE 8080 to document default port
    • Fix healthcheck to respect custom port flag
    • Add entrypoint wrapper to preserve -logtostderr flag
    • add std in summary
    • fix formatting
    • Update container/docker/factory.go
    • Update factory.go
    • Update factory.go
    • Update factory.go
    • Fix for issue #3772
    • docs: replace references to docker registry gcr.io with ghcr.io
    • Expose s390x CPU Topology to Prometheus

  • update to 0.55.1:

    • manager: fix race condition in Stop() using sync.Once
    • manager: fix race condition in Stop() using sync.Once

  • update to 0.55.0:

    • Reduce lock contention in manager package
    • container/podman: fix zfsFilesystem and zfsParent being swapped.
    • devicemapper: use atomic.Value for lock-free cache reads
    • Reduce lock contention in cache/memory package
    • zfs: use atomic.Value for lock-free cache reads
    • fix: docker health check status not updating
    • align docker and podman implementations
    • disable CGO for fully static binaries
    • close stale PRs and Issues
    • refactor(container): Migrate to std lib context package
    • add workflow_dispatch to stale github action
    • plugin factory: remove useless RegisterPlugin log output
    • feat(summary): add count in percentiles
    • machine: fixes for unix.Uname use
    • feat: add LoadTaskProcess api in containerd client
    • feat: add exit code in container deletion events
    • feat: add CRI-O integration tests
    • test: reorganize integration tests and add CRI-O test coverage
    • refactor: remove duplicate tests from api package and add missing CRI-O tests
    • fix: update golang.org/x/crypto to v0.45.0 to fix security …
Record
openSUSE-SU-2026:21265-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21379-1 No score

Security update for ctop

This update for ctop fixes the following issues:

Changes in ctop embedded dependencies:

  • CVE-2022-21698: client_golang: Denial of service using InstrumentHandlerCounter (bsc#1248710)
  • CVE-2024-45310: runc: runc can be tricked into creating empty files (bsc#1257431)
  • CVE-2026-10722: ebpf: Crash when parsing malformed ELF/BTF input (bsc#1267805)
  • CVE-2026-33814: net: Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265800)
  • CVE-2026-39821: net: Failure to reject ASCII-only Punycode-encoded labels (bsc#1266632)
Record
openSUSE-SU-2026:21379-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21442-1 No score

Security update for alloy

This update for alloy fixes the following issue:

Update to version 1.17.1.

Security issue fixed:

  • CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed (bsc#1267811).

Other updates and bugfixes:

  • Version 1.17.1:
    • Back off usage reporting on persistent failure instead of retrying every minute.
Record
openSUSE-SU-2026:21442-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21574-1 No score

Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue:

Update to version 1.106.0.

Security issues fixed:

  • CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed (bsc#1267794).

Other updates and bugfixes:

  • Version 1.106.0:
    • Feature - Feature - Add FIS-driven DNS refresh add-sources endpoint for network-latency and network-packet-loss faults (#5029)
    • Enhancement - Enhancement: Update SSM Agent version to 3.3.4624.0 for ECS exec (#5054)
    • Enhancement - Backfill host DNS config on isolated platform (#5047)
    • Enhancement - Bump github.com/aws/smithy-go from 1.27.3 to 1.27.4 in /agent (#5051)
    • Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials in /ecs-agent, /agent and /ecs-init to 1.19.29 (#5050)
    • Enhancement - Bump actions/setup-go from 6 to 7 in /.github/workflows (#5049)
    • Enhancement - Update Go version to 1.25.12 (#5048)
    • Enhancement - Bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.1 in /ecs-agent, /agent and /ecs-init (#5037)
    • Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.22 to 1.19.28 in /agent (#5038)
    • Enhancement - Bump github.com/hectane/go-acl from 0.0.0-20190604041725-da78bae5fc95 to 1.0.0 in /agent (#5022)
    • Enhancement - chore(deps): bump github.com/cilium/ebpf from v0.16.0 to v0.22.0 in /agent (#5034)
    • Enhancement - Bump golang.org/x/net from 0.48.0 to 0.55.0 in /ecs-agent/daemonimages/csidriver (#5031)
    • Enhancement - api-2.json: Add CONFIDENTIAL_PARTITION and attestationPolicy to api model (#5033)
    • Bugfix - Fix flaky TestHostResourceManagerTrickleQueue integration test (#5026)
Record
openSUSE-SU-2026:21574-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21899-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
openSUSE-SU-2026:21899-1
Updated
2026-11-02
OSVSUSE-SU-2026:22946-1 No score

Security update for alloy

This update for alloy fixes the following issue:

Update to version 1.17.1.

Security issue fixed:

  • CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed (bsc#1267811).

Other updates and bugfixes:

  • Version 1.17.1:
    • Back off usage reporting on persistent failure instead of retrying every minute.
Record
SUSE-SU-2026:22946-1
Updated
2026-11-02
OSVSUSE-SU-2026:22954-1 No score

Security update for alloy

This update for alloy fixes the following issue:

Update to version 1.17.1.

Security issue fixed:

  • CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed (bsc#1267811).

Other updates and bugfixes:

  • Version 1.17.1:
    • Back off usage reporting on persistent failure instead of retrying every minute.
Record
SUSE-SU-2026:22954-1
Updated
2026-11-02
OSVSUSE-SU-2026:23234-1 No score

Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue:

Update to version 1.106.0.

Security issues fixed:

  • CVE-2026-10722: github.com/cilium/ebpf: interger overflow when performing BTF string offset boundary check can lead to crash when malformed ELF/BTF input is parsed (bsc#1267794).

Other updates and bugfixes:

  • Version 1.106.0:
    • Feature - Feature - Add FIS-driven DNS refresh add-sources endpoint for network-latency and network-packet-loss faults (#5029)
    • Enhancement - Enhancement: Update SSM Agent version to 3.3.4624.0 for ECS exec (#5054)
    • Enhancement - Backfill host DNS config on isolated platform (#5047)
    • Enhancement - Bump github.com/aws/smithy-go from 1.27.3 to 1.27.4 in /agent (#5051)
    • Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials in /ecs-agent, /agent and /ecs-init to 1.19.29 (#5050)
    • Enhancement - Bump actions/setup-go from 6 to 7 in /.github/workflows (#5049)
    • Enhancement - Update Go version to 1.25.12 (#5048)
    • Enhancement - Bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.1 in /ecs-agent, /agent and /ecs-init (#5037)
    • Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.22 to 1.19.28 in /agent (#5038)
    • Enhancement - Bump github.com/hectane/go-acl from 0.0.0-20190604041725-da78bae5fc95 to 1.0.0 in /agent (#5022)
    • Enhancement - chore(deps): bump github.com/cilium/ebpf from v0.16.0 to v0.22.0 in /agent (#5034)
    • Enhancement - Bump golang.org/x/net from 0.48.0 to 0.55.0 in /ecs-agent/daemonimages/csidriver (#5031)
    • Enhancement - api-2.json: Add CONFIDENTIAL_PARTITION and attestationPolicy to api model (#5033)
    • Bugfix - Fix flaky TestHostResourceManagerTrickleQueue integration test (#5026)
Record
SUSE-SU-2026:23234-1
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02
OSVSUSE-SU-2026:23853-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
SUSE-SU-2026:23853-1
Updated
2026-11-02
OSVSUSE-SU-2026:23865-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
SUSE-SU-2026:23865-1
Updated
2026-11-02
OSVSUSE-SU-2026:2824-1 No score

Security update for alloy

This update for alloy fixes the following issues

  • CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing malformed ELF/BTF input (bsc#1267811).
  • CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267185).
  • CVE-2026-33532: Denial of Service via deeply nested YAML document parsing (bsc#1260981).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1266196).
  • CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: SQL injection when placeholders in dollar-quoted string literals are used in the SQL query (bsc#1265440).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
  • CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
  • CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
  • CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes a DoS (bsc#1267488).
  • CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash the OBI process and cause denial of service (bsc#1267489).
Record
SUSE-SU-2026:2824-1
Updated
2026-11-02
OSVSUSE-SU-2026:4210-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout='1m', read_header_timeout='1m', write_timeout='30s' to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
SUSE-SU-2026:4210-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/cilium/ebpf
Go
 before 0.22.0
0.22.0
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
kata-containers-preview
Azure Linux:3
 through 3.27.0~preview2-2 None known
golang-github-cilium-ebpf
Debian:12
 All versions, plus listed versions
0.11.0-10.11.0-20.17.3+ds1-10.17.3+ds1-20.17.3+ds1-3
Show 5 moreShow less
0.17.3+ds1-40.21.0+ds1-10.21.0+ds1-20.22.0+ds1-10.9.1-1
 None known
golang-github-cilium-ebpf
Debian:13
 All versions, plus listed versions
0.11.0-20.17.3+ds1-10.17.3+ds1-20.17.3+ds1-30.17.3+ds1-40.21.0+ds1-10.21.0+ds1-20.22.0+ds1-1
 None known
golang-github-cilium-ebpf
Debian:14
 before 0.22.0+ds1-1, plus listed versions
0.11.0-20.17.3+ds1-10.17.3+ds1-20.17.3+ds1-30.17.3+ds1-40.21.0+ds1-10.21.0+ds1-2
0.22.0+ds1-1
alloy
SUSE:Linux Enterprise Server 16.0
 before 1.17.1-160000.1.1
1.17.1-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.17.1-160000.1.1
1.17.1-160000.1.1
amazon-ecs-init
SUSE:Linux Enterprise Server 16.0
 before 1.106.0-160000.1.1
1.106.0-160000.1.1
Show 21 moreShow less
Affected packages
PackageAffectedFixed
amazon-ecs-init
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.106.0-160000.1.1
1.106.0-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
alloy
SUSE:Linux Enterprise Server 16.0
From an advisory covering 7 CVEs
 before 1.18.0-160000.1.1
1.18.0-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 1.18.0-160000.1.1
1.18.0-160000.1.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 27 CVEs
 before 1.17.1-150700.15.23.1
1.17.1-150700.15.23.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 1.18.0-150700.15.26.1
1.18.0-150700.15.26.1
golang-github-cilium-ebpf
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.2.0-10.6.2-20.7.0-1
 None known
golang-github-cilium-ebpf
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.1-10.11.0-10.11.0-2
 None known
golang-github-cilium-ebpf
Ubuntu:25.10
 All versions, plus listed versions
0.11.0-2
 None known
golang-github-cilium-ebpf
Ubuntu:26.10
 All versions, plus listed versions
0.17.3+ds1-40.21.0+ds1-10.21.0+ds1-20.22.0+ds1-1
 None known
golang-github-cilium-ebpf
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.0-20.17.3+ds1-4
 None known
cadvisor
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.60.3-1.1
0.60.3-1.1
alloy
openSUSE:Tumbleweed
 before 1.17.1-1.1
1.17.1-1.1
amazon-ecs-init
openSUSE:Tumbleweed
 before 1.106.0-1.1
1.106.0-1.1
cadvisor
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 0.60.3-bp160.1.1
0.60.3-bp160.1.1
ctop
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 0.7.7-bp160.2.1
0.7.7-bp160.2.1
alloy
openSUSE:Leap 16.0
 before 1.17.1-160000.1.1
1.17.1-160000.1.1
amazon-ecs-init
openSUSE:Leap 16.0
 before 1.106.0-160000.1.1
1.106.0-160000.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
alloy
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 1.18.0-160000.1.1
1.18.0-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-10722 is a medium vulnerability (CVSS 4.8) in Cilium Ebpf, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in github.com/cilium/ebpf 0.22.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 62 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open