CVE-2026-41607

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

These are all security issues fixed in the libthrift-0_23_0-0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-11.6.14+security04-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• Add UI web assets as additional source tarball

• Update to version 12.4.5 (jsc#PED-16512):

  • Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid

• Update to version 12.4.4:

  • Security and quality updates.
  • Various bug fixes and enhancements.

• Update to version 12.4.3:

  • Analytics: Keep internal dashboard id.
  • Go: Update to 1.25.9.
  • Reporting: Correctly apply appSubURL to report settings requests.
  • Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.

• Update to version 12.4.2:

  • Various bug fixes and performance improvements.
  • Dependency updates to core plugins and UI libraries.

• Update to version 12.4.1:

  • Bug fixes and minor quality-of-life enhancements.
  • Updates to data source provisioning and dashboard schemas.

• Update to version 12.4.0:

  • Introduced dynamic dashboards in public preview.
  • Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
  • Added the ability to create dashboards from templates using sample data.
  • Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
  • Added support to map one variable to multiple values.
  • CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)

• Update to version 12.3.0:

  • Released a completely redesigned logs visualization.
  • Added the ability to export dashboards directly as PNG images.
  • Introduced an interactive learning experience within the Grafana UI.
  • Added a Switch template variable type to quickly toggle between values in queries.
  • Added functionality to style table cells using CSS properties via the field cell option.

• Update to version 12.2.0:

  • Routine feature enhancements, minor bug fixes, and security patches.

• Update to version 12.1.0:

  • Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
  • Redesigned the alert rule list page.
  • Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
  • Added support for Service Account Impersonation in the BigQuery data source.
  • Introduced the Grafana Advisor in public preview.

• Update to version 12.0.0:

  • BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
  • BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
  • BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.
  • MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
  • Introduced a new dashboard schema to replace the original single grid layout.

• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
• CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
• CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
• CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
• CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…

This update for terraform-provider-susepubliccloud fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263316).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:

• Security fixes:

  • CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
  • CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
  • CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
  • CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)

• Other bugs fixed and changes:

  • STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint
  • Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update fixes the following issues:

prometheus-postgres_exporter:

• CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass and privilege escalation (bsc#1248699)

golang-github-prometheus-alertmanager:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:

Security fixes:

• CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
• CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
• CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
• CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)

Other changes and fixes:

• STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint
• Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update for grafana fixes the following issues:

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
• CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
• CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
• CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

• BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
• BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
• BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

• Add Legal-Review-Notice (bsc#1271327)
• Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
• Analytics: Keep internal dashboard id.
• Reporting: Correctly apply appSubURL to report settings requests
• Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
• Dependency updates to core plugins and UI libraries.
• Updates to data source provisioning and dashboard schemas.
• Introduced dynamic dashboards in public preview.
• Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
• Added the ability to create dashboards from templates using sample data.
• Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
• Added support to map one variable to multiple values.
• Released a completely redesigned logs visualization.
• Added the ability to export dashboards directly as PNG images.
• Introduced an interactive learning experience within the Grafana UI.
• Added a Switch template variable type to quickly toggle between values in queries.
• Added functionality to style table cells using CSS properties via the field cell option.
• Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
• Redesigned the alert rule list page.
• Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
• Added support for Service Account Impersonation in the BigQuery data source.
• Introduced the Grafana Advisor in public preview.
• Introduced a new dashboard schema to replace the original single grid layout.
• MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout='1m', read_header_timeout='1m', write_timeout='30s' to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md