CVE-2026-84303

Summary

A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).

Impact

When an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.

Furthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.

Patches

The problem is fixed in master and in the 1.83.1 release.

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing.

These are all security issues fixed in the helm3-3.21.3-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cadvisor-0.60.5-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the distribution-registry-3.1.1-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the hauler-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.74.0-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm-4.2.4-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the google-osconfig-agent-20260908.00-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apptainer-1.5.3-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mcphost-0.34.0-11.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.54.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-7.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the warewulf4-4.7.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

• CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates (bsc#1258543).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278624).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279390).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1279392).

This update for helm fixes the following issues:

Update to version 3.21.1:

• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for google-cloud-sap-agent fixes the following issues:

Security issues fixed:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279304).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278987).

Non security issue fixed:

• re-enable stripping and debuginfo (bsc#1210938).

This update for hauler fixes the following issues:

Changes in hauler:

• update vendor.tar to fix:

  • bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library

• update vendor.tar to fix:

  • bsc#1279416, CVE-2026-84304
  • bsc#1279296, CVE-2026-84303
  • bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers

Update to 2.1.0 (bsc#1265425, CVE-2026-41888).

This update for cadvisor fixes the following issues:

Changes in cadvisor:

update vendor.tar to fix:

• bsc#1279044, CVE-2026-84445
• bsc#1279224, CVE-2026-84304
• bsc#1279320, CVE-2026-84303: cadvisor: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276722).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

• Update to version 20260911.00

• Add support for all possible SCALIBR os extractor for linux (#1052)
• Migrate presubmits from deb11 to deb12 (#1050)
• Bump the go_modules group across 1 directory with 3 updates (#1047)
• Introduce E2E v2 framework and inventory tests (#1039)
• Remove test case for asserting JSON marshal error from task_state.go (#1045)
• security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)
• Add Configuration for SCALIBR (#1034)
• add CheckState and Cleanup tests (#1008)
• Improve unit tests for osinfo/osinfo_linux.go (#1020)
• Bump github.com/go-git/go-git/v5 (#1036)
• Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)
• Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)
• authenticate cloud build to use docker registry (#1030)
• Migrate e2e build to internal image (#1024)
• Upgrade google.golang.org/grpc to new version. (#1023)
• Improve unit tests for ospatch/yum_update.go (#1012)
• Improve unit tests for ospatch/updates.go (#1011)
• Add unit tests for config/package_resource.go PART 2 (#1005)
• Add unit tests for config/package_resource.go PART 1 (#1003)
• Add unit tests for policies/local.go (#1015)
• Add unit tests for repository_resource.go (#1002)
• Add unit tests for installrecipe.go part 2 (#993)
• Add unit tests for scalibr.go (#1019)
• Add unit tests for installrecipe.go part 1 (#992)
• Add test cases for policies/recipes/recipedb.go (#989)
• Bump golang.org/x/crypto (#1021)
• Add unit tests for policies/recipes/steps.go PART 3 (#976)
• Add unit tests for policies/recipes/steps.go PART 2 (#975)
• Bump golang.org/x/net (#1017)
• upgrade x/net package. (#1018)
• Add test cases for config/file_resource.go (#988)
• Add unit tests for policies/recipes/artifacts.go (#985)
• Add unit tests for policies/recipes/steps.go PART 1 (#974)
• Add tests & bugfix for packages/trace.go (#939)
• Add unit tests for agentendpoint/agentendpoint_beta.go (#983)
• Replace yum install with yum update (#1009)
• Bump github.com/containerd/containerd (#1013)
• Add unit tests for policies/apt.go PART 2 (#957)
• Add test cases for agentendpoint/task_state.go (#984)
• Remove deprecated rhel-sap images and add new ones (#1007)
• Add test cases for clog/clog.go (#986)

This update for mcphost fixes the following issues:

• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279274).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279396).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278853).

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

• Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
• GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
• GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
• GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
• GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
• GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
• GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
• GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
• GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
• GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
• GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
• GO-2026-6449 GHSA-hxjg-93wc-h8p8
• GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
• GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
• GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
• GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
• GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
• GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
• GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
• GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
• GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
• GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
• GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
• GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
• GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
• GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
• GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
• GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
• GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
• GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
• GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
• GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
• GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
• GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
• GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v

• Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.

• GO-2026-6302 GHSA-mf7q-r4rv-jv94
• GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
• GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
• GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
• GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
• GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
• GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
• GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
• GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
• GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
• GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
• GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
• GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
• GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
• GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
• GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
• GO-2026-6364 GHSA-99rq-75j6-5j9f
• GO-2026-6365 GHSA-gw25-m53r-qh88
• GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
• GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
• GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
• GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
• GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
• GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
• GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
• GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
• GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
• GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
• GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
• GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
• GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
• GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
• GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
• GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
• GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
• GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
• GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
• GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
• GO-2026-6404 CVE-2026-72803…

This update for distribution fixes the following issues:

• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276677).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279316).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278997).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276677).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279316).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278997).

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)
• Fix
  • a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),
  • a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236),
  • a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2

This update for v2ray-core fixes the following issues:

Changes in v2ray-core:

• Update version to 5.54.2

  • Add iOS Client Support Bundle: Packet Bridge Receiver, Subscription Improvment, DNS and other udp improvement
  • Add Wireguard Chain Proxy Support
  • Fix bugs
  • Update vendored dependencies (boo#1266787, CVE-2026-39821, boo#1278801, CVE-2026-84445, boo#1279262, CVE-2026-84303, boo#1279411, CVE-2026-84304)

• Update dlc.dat and geoip.dat

This update for amazon-ecs-init fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276744).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279329).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231).

Changes for amazon-ecs-init:

• Update to version 1.107.0

• Feature - Add MPS GPU Sharing capability (#5139)
• Enhancement - Add MPS control daemon health gate task resource (#5107)
• Enhancement - Surface MPS control-daemon impairment reason as StatusReason (#5125)
• Enhancement - Attach the MPS control daemon health gate to MPS tasks (#5119)
• Enhancement - Add ACCELERATED_COMPUTE health check for the MPS control daemon (#5124)
• Enhancement - Fetch GPG keys from S3 instead of GitHub in ECS Anywhere install script (#5130)
• Enhancement - Bump github.com/prometheus/common from 0.66.1 to 0.71.0 in /ecs-agent (#5117)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.32 to 1.20.4 in /agent (#5128)
• Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.35 in /ecs-init (#5133)
• Enhancement - Bump google.golang.org/grpc from 1.82.1 to 1.83.1, this also updated go.opentelemetry.io/otel to v1.44.0 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5123)
• Enhancement - Bump k8s.io/api from 0.28.1 to 0.37.0 in /agent (#5118)
• Enhancement - Correct broken systemd link in README (#5129)
• Enhancement - Bump golang.org/x/text and related dependencies (#5100)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.18.33 to 1.18.38 in /ecs-agent (#5093)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.35.2 to 1.44.7 in /agent (#5094)
• Enhancement - Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3 (#5108)
• Enhancement - Update Go version to 1.26.7 (#5105)
• Enhancement - Add amazon-ecs-agent.gpg and amazon-ssm-agent.gpg to the CodePipeline release artifacts (#5101)
• Enhancement - IMDS credentials scanner/refresher: Add logging and validations (#5091)
• Enhancement - Bump github.com/containerd/cgroups/v3 from 3.0.4 to 3.1.3 in /agent (#5081)
• Enhancement - Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /ecs-agent and /agent (#5085)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.29 to 1.19.32 in /ecs-agent, /agent and /ecs-init (#5080)
• Bugfix - fix(handlers): raise fault rate limit to 1 rps (#5092)
• Feature - Nvidia MPS GPU sharing (not yet enabled)
• Add MPS control-daemon health probe (#5095)
• Add per-GPU memory accounting to host resource manager (#5090)
• Allow MPS containers to colocate on a shared GPU (#5083)
• Mount MPS control binary and pipe dir into the agent container (#5086)
• Move MPS pipe directory to /run/mps-ecs (#5102)
• Enhancement - Add retry for EFS volume creation to handle plugin timeout errors caused by concurrent mount operation (#5077)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.32.23 to 1.32.31 in /agent (#5064)
• Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /ecs-agent/daemonimages/csidriver (#5056)
• Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1 in /ecs-agent (#5063)
• Enhancement - add nos3readcache S3 Files mount option (#5062)
• Add ecs.capability.gpu-sharing-mps capability for NVIDIA MPS GPU sharing (#5053)
• Inject NVIDIA MPS env vars and pipe mount into MPS containers (#5082)
• Map ACS GPU sharingStrategy onto the internal container model for MPS (#5076)
• Gate gpu-sharing-mps on complete per-GPU memory- (#5075) (#5075)
• Regenerate ACS model for GPU sharingStrategy and validate it (#5071)
• Report per-GPU memory at…

This update for gh fixes the following issues:

Changes in gh:

• Update to version 2.102.0, fixing four security issues (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g):

  • gh release/run/attestation download and repo read-file --output could write to an unintended file through symbolic links
  • gh attestation verify compared --source-ref case-insensitively
  • gh attestation verify matched --signer-workflow only by prefix
  • gh skill search could inject options into gh skill install
  • Copy auth codes to the clipboard by default (gh config set clipboard disabled to opt out)
  • Remove the gh repo garden command and the multi-account migration
  • Use API SSH URLs for repository clones
  • Validate repository names during interactive creation
  • Fix remote branch deletion on owner case mismatch
  • Propagate the gh path to extensions
  • Allow ghu_ tokens to attach files
  • Allow gh repo set-default --unset without an argument
  • Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0, github.com/klauspost/compress to 1.20.1 and Go to 1.27.1

• Update golang.org/x/net to 0.60.0 to fix excessive CPU consumption on repeated HTTP/2 initial window changes (CVE-2026-78669, bsc#1285291).

• Require golang(API) >= 1.27 as upstream moved to Go 1.27.

• Not affected, vendored dependencies are above the fixed version:

  • CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2
  • CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310): grpc is 1.83.2, fixed in 1.83.1
  • CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in 1.44.0
  • CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1, contains the fix of 1.18.7
  • CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed version
  • CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last affected version

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

• Update google.golang.org/grpc to which fixes:
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278760)
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279257)

This update for rqlite fixes the following issues:

Changes in rqlite:

• Update to version 10.6.6:

  • Keep the local auto-backup file if the metadata rename fails
  • Reject local auto-backup filenames reserved for internal use
  • POST /demote and POST /promote return a JSON error body, and 404 when the target node is not in the cluster.
  • DELETE /remove returns a JSON error body.

• Includes changes from version 10.6.5:

  • Guard the inter-node backup stream handler directly against a missing backup request
  • POST /leader returns a JSON error body, and 404 when the target node is not in the cluster

• Update to version 10.6.4:

  • BACKUP_STREAM authorization failures can disclose the database and crash rqlited (boo#1286934)
  • GET /leader returns a JSON error body when there is no leader
  • Close the connection after rejecting an unauthorized inter-node backup stream request, instead of streaming the database anyway
  • Decide inter-node command authorization once, before dispatch, and close the connection after rejecting any unauthorized command

• Update to version 10.6.3:

  • Node probes honor request context and commit exactly one result
  • Make DB connections a first-class object
  • Prevent ATTACH on the query database connection

• Update to version 10.6.2:

  • Check for trailing junk in request bodies
  • Console schema view handles table names that collide with JavaScript object properties
  • Set CommitTimestamps in CDC Events Group
  • Upgrade dependencies

• Update to version 10.6.1:

  • Use constant-time comparison when comparing passwords
  • Conditionally rewrite SQL during queued writes and fix rewriting of CURRENT_TIMESTAMP and related tokens
  • More robust Leader stepdown node ID detection, reap checks, and SQL analyze start-time recording
  • CDC fixes: encode non-finite floats, always release flush waiters, and make the HTTP sink follow redirects
  • Converted _service from mode=disabled to mode=manual (legacy leftover; services are run by hand via osc service manualrun)
  • Package is not affected by CVE-2026-84445 (boo#1278793), CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253): vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
  • Package is not affected by CVE-2026-89090 (boo#1280657): vendored eventstream is v1.7.20, above the v1.7.8 fix
  • Package is not affected by CVE-2026-63209 (boo#1283555): vendored klauspost/compress is v1.20.1, above the v1.18.7 fix
  • Package is not affected by CVE-2026-39821 (boo#1266544): vendored golang.org/x/net is v0.59.0, above the v0.55.0 fix

• Update to version 10.6.0:

  • API addition: error_v2 may contain numeric SQLite error codes.
  • addresses a security issue related to Authentication files. A user with no explicit permissions could be grant elevated permissions. Correctly configured users do not suffer from this issue.
  • multiple implementation changes and bug fixes
  • Display interactive cluster topology on web console.
  • Support configurable queued-writes retries
  • release addresses a gap in the role-based access permissions related to change-data-capture (CDC) handling

• Update to version 10.3.6:

  • Add query logging to database layer
  • Snapshot IDs now contain (optional) generation
  • Bump generation ID if snapshot IDs collide
  • Snapshots can be filtered by term and index
  • Add support for File Renaming and Removing with retries
  • Replace standard library with fsutil
  • Keep snapshot ordering correct regardless of clock
  • Remove snapshot name generation ID

• Update to version 10.3.5:

  • Reject alternate form of unsupported PRAGMA commands
  • Handle negative trailing logs
  • Sync access to last backup time at http layer
  • Set the "Served by" header before first backup byte
  • Set DB load response time for all formats
  • Fix HTTP logic error for queued statements
  • Minor web console fixes

• includes…

This update for helm fixes the following issues:

Update to version 3.21.1:

• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for helm fixes the following issues:

• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).

This update for google-osconfig-agent fixes the following issues:

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

• Update to version 20260908.00

• Migrate presubmits from deb11 to deb12 (#1050)
• Bump the go_modules group across 1 directory with 3 updates (#1047)
• Introduce E2E v2 framework and inventory tests (#1039)
• Remove test case for asserting JSON marshal error from task_state.go (#1045)
• security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)
• Add Configuration for SCALIBR (#1034)
• add CheckState and Cleanup tests (#1008)
• Improve unit tests for osinfo/osinfo_linux.go (#1020)
• Bump github.com/go-git/go-git/v5 (#1036)
• Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)
• Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)
• authenticate cloud build to use docker registry (#1030)
• Migrate e2e build to internal image (#1024)
• Upgrade google.golang.org/grpc to new version. (#1023)
• Improve unit tests for ospatch/yum_update.go (#1012)
• Improve unit tests for ospatch/updates.go (#1011)
• Add unit tests for config/package_resource.go PART 2 (#1005)
• Add unit tests for config/package_resource.go PART 1 (#1003)
• Add unit tests for policies/local.go (#1015)
• Add unit tests for repository_resource.go (#1002)
• Add unit tests for installrecipe.go part 2 (#993)
• Add unit tests for scalibr.go (#1019)
• Add unit tests for installrecipe.go part 1 (#992)
• Add test cases for policies/recipes/recipedb.go (#989)
• Bump golang.org/x/crypto (#1021)
• Add unit tests for policies/recipes/steps.go PART 3 (#976)
• Add unit tests for policies/recipes/steps.go PART 2 (#975)
• Bump golang.org/x/net (#1017)
• upgrade x/net package. (#1018)
• Add test cases for config/file_resource.go (#988)
• Add unit tests for policies/recipes/artifacts.go (#985)
• Add unit tests for policies/recipes/steps.go PART 1 (#974)
• Add tests & bugfix for packages/trace.go (#939)
• Add unit tests for agentendpoint/agentendpoint_beta.go (#983)
• Replace yum install with yum update (#1009)
• Bump github.com/containerd/containerd (#1013)
• Add unit tests for policies/apt.go PART 2 (#957)
• Add test cases for agentendpoint/task_state.go (#984)
• Remove deprecated rhel-sap images and add new ones (#1007)
• Add test cases for clog/clog.go (#986)
• Use explicit upstream GitHub homepage in URL field

This update for helm fixes the following issues:

Update to version 3.21.1:

• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for google-cloud-sap-agent fixes the following issues:

Security issues fixed:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279304).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278987).

Non security issue fixed:

• re-enable stripping and debuginfo (bsc#1210938).

This update for google-cloud-sap-agent fixes the following issues:

Security issues fixed:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279304).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278987).

Non security issue fixed:

• re-enable stripping and debuginfo (bsc#1210938).

This update for helm fixes the following issues:

• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

• Update to version 20260908.00

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)