CVE-2026-41606

Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

These are all security issues fixed in the libthrift-0_23_0-0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-12.4.5-5.1 package on the GA media of openSUSE Tumbleweed.

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for grafana fixes the following issues:

Changes in grafana:

Update to version 12.4.10:

• Security:

  • CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
  • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
  • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
  • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

• Bug fixes:

  • Dashboards: Fix adhoc and groupby variable datasource on UI import
  • Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

• Features and enhancements:

  • Dashboard Import: Labels in v2 schema

• Bug fixes:

  • Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

• Security:

  • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

• Security:

  • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

• Features and enhancements:

  • Dashboards: Get annotations and dashboard endpoint performance improvements

• Bug fixes:

  • DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

• Security:

  • CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

• Features and enhancements:

  • Alerting: Add protected fields authorization check to provisioning API
  • Alerting: Return 403 instead of 500 on contact point provenance mismatch

• Bug fixes:

  • Jaeger: Handle gzip, deflate, and brotli compressed API responses
  • Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)

• CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)

• CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)

• CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)

• CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

• CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)

• CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
• CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
• CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
• CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
• CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…

This update for terraform-provider-susepubliccloud fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263316).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout='1m', read_header_timeout='1m', write_timeout='30s' to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…

This update for grafana, system-user-grafana fixes the following issues:

• Update to version 12.4.10:

  • Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
  • Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page

• Update to version 12.4.9:

  • Features and enhancements: Dashboard Import: Labels in v2 schema
  • Bug fixes: Azure Monitor: fix migration for dimension filters

• Update to version 12.4.8:

  • Security: CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

• Update to version 12.4.7:

  • Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
  • Features and enhancements: Dashboards: Get annotations and dashboard endpoint performance improvements
  • Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

• Update to version 12.4.6:

  • Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
  • Features and enhancements: Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
  • Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• Drop 0005-Bump-edwards25519.patch

  CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

  • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
  • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

• Build only for SUSE distributions