CVE-2026-41602

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Root has patched CVE-2026-41602 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

These are all security issues fixed in the libthrift-0_23_0-0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-11.6.14+security01-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-cloudwatch-agent-1.300066.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.16.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for alloy fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Changes for alloy:

• Update to version 1.16.1

• Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby

This update for grafana fixes the following issues:

Changes in grafana:

• CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

• Update to version 11.6.14+security-04: Security:

  • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
  • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
  • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
  • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
  • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
  • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
  • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
  • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
  • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
  • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

• CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

• CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

• CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

• CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

• Update to version 11.6.14+security-01: Security:

  • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

• Update to version 11.6.14: Security:

  • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Update to version 11.6.13: Enhancement:

  • Wire the public dashboard service to the HTTP server

• Update to version 11.6.12: Enhancement:

  • Update authentication redirect logic Bug fix:
  • Fix single panel render with variable references

This update for alloy fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Changes for alloy:

• Update to version 1.16.1

• Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Security Fixes:

  • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

• Backward Compatibility and packaging changes:

  • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
  • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

• Version 1.10.2:

  • Fixed typo in Zswap metric name (meminfo)

• Version 1.10.1:

  • Fixed mount points being collected multiple times (filesystem)
  • Refactored mountinfo parsing (bsc#1261810)
  • Added Zswap/Zswapped metrics (meminfo)

• Version 1.10.0:

  • New collectors: PCIe devices, swaps
  • Added systemd virtualization metrics, AIX metrics
  • WiFi packet metrics, additional PCIe and TLB metrics
  • Changed mdadm to use sysfs, added erofs to excluded filesystems
  • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

• Security issues fixed:

  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
  • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
    • Bump google.golang.org/grpc to version 1.79.3
  • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
    • Bump rollup to version 4.59.0

• Other changes:

  • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

• Security Fixes:

  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
  • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

• Highlights of other changes and bug fixes:

  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

• Security Fixes:

  • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Highlights of other changes and bug fixes:

  • Version 11.6.13:

    • Wire the public dashboard service to the HTTP server

  • Version 11.6.12:

    • Update authentication redirect logic
    • Fixed single panel render with variable references

spacecmd:

• Version…

This update for grafana to version to 11.6.14+security01 fixes the following issues:

• Security Fixes:

  • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
  • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
  • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
  • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
  • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
  • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
  • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
  • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
  • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

• Highlights of other changes and bug fixes:

  • Version 11.6.13:

    • Wire the public dashboard service to the HTTP server

  • Version 11.6.12:

    • Update authentication redirect logic
    • Fixed single panel render with variable references

This update for alloy fixes the following issues

Security issues:

• CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).
• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Non security issue:

• Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
• Update to version 1.16.1

• Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby

• Use latest openSUSE Tumbleweed image for building web UI assets
• Install nvm to set node version specified upstream
• update to 1.16.0:

• Features

• Add clustering for loki.source.kubernetes_events (#6027) (3dbf587) (@petewall)
• Add otelcol.auth.google client auth provider (#5526) (da99a66) (@dashpole, @clayton-cornell)
• beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
• database_observability: Add support for GCP Cloud SQL metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
• database_observability: Make targets optional (#5924) (54664b2) (@matthewnolf)
• database_observability: Update default excluded schemas and users (#6080) (b386fff) (@cristiangreco)
• faro.receiver: Add sourcemap fetching from remote locations (#4614) (b6cb5da) (@Oxel40)
• helm: Add support for global.image.pullPolicy (#6069) (2e2ce72) (@petewall)
• helm: Allow configuring image pull policy for config reloader (#5923) (991539b) (@kalleep)
• loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
• loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#5855) (053a2f7) (@kleimkuhler)
• loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#5909) (c16a660) (@mikefat)
• loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#5970) (b16decb) (@kleimkuhler)
• Oracle exporter can scrape more than one DB (#6008) (6fbad38) (@ptodev)
• prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
• prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#5836) (4f49b57) (@cristiangreco)
• prometheus.remote_write: Sync WAL with upstream Prometheus (#5907) (e74a91b) (@x1unix)
• pyroscope: Add support for extra async-profiler CLI arguments (#5472) (9251e33) (@ivanape)
• pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
• pyroscope: Update debuginfo client for HTTP/1.1 upload API (#6037) (879d8e5) (@korniltsev-grafanista)
• Change service stop command from 'sc' to 'net' (#5906) (450973d) (@mateuszdrab)
• database_observability.mysql: Refactor explain plan loop batch size (#5894) (f0fcd6b) (@cristiangreco)
• database_observability.postgres: Cleanup embedded exporter collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
• database_observability.postgres: Fix EXPLAIN param count when placeholders repeat (#6082) (b612b81) (@rgeyer)
• database_observability: Drop schema_detection from logs (#6076) (b0105cb) (@cristiangreco) -…

This update fixes the following issues:

dracut-saltboot updated to version 1.2.1:

• Key Update Highlights (v1.2.1)
  • Added wait check for minion start (default 10s), configurable using rd.saltboot.salt_start_timeout option (bsc#1260870)
  • Decouple salt key wait check to use separate configurable option rd.saltboot.salt_key_timeout, with default 60s
  • Introduce rd.saltboot namespace for all options, mark old as deprecated

golang-github-QubitProducts-exporter_exporter:

• Security issues fixed:
  • CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter (bsc#1248699)

golang-github-boynux-squid_exporter:

• Non customer facing changes

golang-github-lusitaniae-apache_exporter:

• Non customer facing changes

golang-github-prometheus-alertmanager:

• Non customer facing changes

golang-github-prometheus-node_exporter updated to version 1.10.2:

• Key Update Highlights (v1.10.0 to v1.10.2):
  • New Collectors: Added new collectors for PCIe devices and swaps.
  • New Metrics: Introduced metrics for Zswap/Zswapped, Systemd Virtualization, and WiFi packets (received/transmitted)
  • Bug Fixes: Resolved a duplicate collection bug in filesystem mount points, fixed a Zswap metric typo, and patched a logging race condition in systemd.
  • Changes: Switched mdadm to use sysfs for RAID metrics, and added erofs to the default excluded filesystems list.
  • Internal Refactoring: filesystem mountinfo parsing refactor (bsc#1261810)

golang-github-prometheus-prometheus updated to version 3.5.3:

• Security issues fixed:

  • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (v3.5.3) (bsc#1263986)
  • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the limit (v3.5.3) (bsc#1263987)
  • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (v3.5.2) (bsc#1262222).
  • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (backported patch) (bsc#1266608)

• Other changes:

  • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (v3.5.3)
  • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)
  • Internal update with non customer facing changes (v3.5.1)

grafana updated to version 11.6.14+security-04:

• Security issues fixed in v11.6.14+security-04:
  • CVE-2026-28374: Fixed insecure direct object reference in Annotations API (bsc#1265290)
  • CVE-2026-28376: Fixed unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
  • CVE-2026-28383: Fixed unbounded memory allocation in Grafana plugin resources (bsc#1265286)
  • CVE-2026-28380: Fixed broken access control in Snapshot API (bsc#1265287)
  • CVE-2026-33376: Fixed Auth Proxy IPv6 whitelist bypass (bsc#1265285)
  • CVE-2026-28379: Fixed viewer-triggered race condition in Grafana Live (bsc#1265288)
  • CVE-2026-33377: Fixed dashboard Editor Privilege Escalation (bsc#1265284)
  • CVE-2026-33378: Fixed OOM exception in Grafana Data Source Plugin (bsc#1265283)
  • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
  • CVE-2026-33380: Fixed vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)
• Security issues fixed through backported patches:
  • CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)
  • CVE-2026-34986: Fixed panic in JWE decryption (bsc#1262950)
  • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
  • CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Fixed multiple issues when…

This update fixes the following issues:

Release Notes Highlights:

• Update to SUSE Multi-Linux Manager 5.1.4
  • Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions
  • Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0
  • SUSE Liberty Linux 9.6 Support
  • New API Endpoint - listMigrationTargetsWithChannels
  • Debian 12 End-of-Life Notice
  • SUSE Registry URL Change
  • Security fixes: CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198 CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154 CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380 CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378 CVE-2026-33380, CVE-2026-33381
  • Bugs mentioned: bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107 bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583 bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382 bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474 bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591 bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031 bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327 bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902 bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492 bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814 bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966 bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012 bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174 bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289 bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284 bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534

Container images and uyuni-tools changes:

server-attestation-image:

• Version 5.1.15
  • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-hub-xmlrpc-api-image:

• Version 5.1.14
  • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-image:

• Version 5.1.15
  • Healthcheck on disk usage based on taskomatic (bsc#1238890)
  • Added mozilla-nss-sysinit to Dockerfile required for FIPS (bsc#1247707)
  • Do not get repositories from SCC in the server container (bsc#1242916)
  • Added 'susemanager-tools', 'susemanager' and 'susemanager-tools-salt' packages to server-image

server-migration-14-16-image:

• Version 5.1.14
  • Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.1.4

server-postgresql-image:

• Version 5.1.13
  • Healthcheck on disk usage based on taskomatic (bsc#1238890)
  • Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)

server-saline-image:

• Version 5.1.14
  • Use python3*-tornado6 package to make it working with Python 3.11

uyuni-tools:

• Version 5.1.29-0 Check backup status only after database is started (bsc#1262492)
• Version 5.1.28-0
  • Remove waitForTraefik function (bsc#1261902)
  • Fix inspect: missing registry for db image (bsc#1259739)
  • Preserve hub replicas during upgrade (bsc#1262708)
  • Stop automatically unhealthy container
  • Ignore spacewalk-service stop return code.
  • Use correct CA for Report DB (bsc#1260806)
  • Do not call podman healthcheck run to wait for pods to be ready (bsc#1266012)

The following packages are underlying build dependencies and system components used by the containers:

cobbler:

• Added the distro signature for rhel10 (bsc#1265134)

liberate-formula:

• Version 0.1.4
  • No customer facing changes
• Version 0.1.3
  • Liberate formula support for EL10 (bsc#1265975)

prometheus-exporters-formula:

• Version 1.4.3
  • Added support for Python 3.13
  • Drop migrate_formula_data script as it is obsolete

prometheus-postgres_exporter:

-…

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
• CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
• CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
• CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
• CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…

This update for terraform-provider-susepubliccloud fixes the following issues

• CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260180).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
• CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
• CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
• CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263316).
• CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).