Every CVE Search/ Get API key

CVE-2025-29923

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

3.7 LowFix available

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.75%Up 0.7 points since Mar 21, 2025
90%50%10%1%

What each source reports

CVE List Score used 3.7

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
CVE-2025-29923
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2025-7158 3.7

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
EUVD-2025-7158
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-92cp-5422-2mw7 3.7

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

Impact

The issue only occurs when the CLIENT SETINFO command times out during connection establishment. The following circumstances can cause such a timeout:

  1. The client is configured to transmit its identity. This can be disabled via the DisableIndentity flag.
  2. There are network connectivity issues
  3. The client was configured with aggressive timeouts

The impact differs by use case:

  • Sticky connections: Rather than using a connection from the pool on-demand, the caller can stick with a connection. Then you receive persistent out-of-order responses for the lifetime of the connection.
  • Pipelines: All commands in the pipeline receive incorrect responses.
  • Default connection pool usage without pipelining: When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded.

Patches

We prepared a fix in https://github.com/redis/go-redis/pull/3295 and plan to release patch versions soon. Versions 9.7.2, 9.6.3, and 9.5.5 were patched. However, 9.7.2 has been yanked, making 9.7.3 the lowest available 9.7.x version with a patch.

Workarounds

You can prevent the vulnerability by setting the flag DisableIndentity (BTW: We also need to fix the spelling.) to true when constructing the client instance.

Credit

Akhass Wasti Ramin Ghorashi Anton Amlinger Syed Rahman Mahesh Venkateswaran Sergey Zavoloka Aditya Adarwal Abdulla Anam Abd-Alhameed Alex Vanlint Gaurav Choudhary Vedanta Jha Yll Kelani Ryan Picard

Record
GHSA-92cp-5422-2mw7
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
NVD 3.7

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
CVE-2025-29923
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV 3.7

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
CVE-2025-29923
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-92cp-5422-2mw7 3.7

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

Impact

The issue only occurs when the CLIENT SETINFO command times out during connection establishment. The following circumstances can cause such a timeout:

  1. The client is configured to transmit its identity. This can be disabled via the DisableIndentity flag.
  2. There are network connectivity issues
  3. The client was configured with aggressive timeouts

The impact differs by use case:

  • Sticky connections: Rather than using a connection from the pool on-demand, the caller can stick with a connection. Then you receive persistent out-of-order responses for the lifetime of the connection.
  • Pipelines: All commands in the pipeline receive incorrect responses.
  • Default connection pool usage without pipelining: When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded.

Patches

We prepared a fix in https://github.com/redis/go-redis/pull/3295 and plan to release patch versions soon. Versions 9.7.2, 9.6.3, and 9.5.5 were patched. However, 9.7.2 has been yanked, making 9.7.3 the lowest available 9.7.x version with a patch.

Workarounds

You can prevent the vulnerability by setting the flag DisableIndentity (BTW: We also need to fix the spelling.) to true when constructing the client instance.

Credit

Akhass Wasti Ramin Ghorashi Anton Amlinger Syed Rahman Mahesh Venkateswaran Sergey Zavoloka Aditya Adarwal Abdulla Anam Abd-Alhameed Alex Vanlint Gaurav Choudhary Vedanta Jha Yll Kelani Ryan Picard

Record
GHSA-92cp-5422-2mw7
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
Show 15 moreShow less
OSVUBUNTU-CVE-2025-29923 3.7

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
UBUNTU-CVE-2025-29923
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-59156 No score

CVE-2025-29923 affecting package telegraf for versions less than 1.31.0-27

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
AZL-59156
Updated
2026-11-05
OSVAZL-59192 No score

CVE-2025-29923 affecting package keda for versions less than 2.14.1-5

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag DisableIndentity to true when constructing the client instance.

Record
AZL-59192
Updated
2026-11-02
OSVGO-2025-3540 No score

Potential out of order responses when CLIENT SETINFO times out during connection establishment in github.com/redis/go-redis

Potential out of order responses when CLIENT SETINFO times out during connection establishment in github.com/redis/go-redis

Record
GO-2025-3540
Updated
2026-11-02
OSVopenSUSE-SU-2025:14937-1 No score

govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14937-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15052-1 No score

grafana-11.5.4-1.1 on GA media

These are all security issues fixed in the grafana-11.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15052-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15508-1 No score

rekor-1.4.1-1.1 on GA media

These are all security issues fixed in the rekor-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15508-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20654-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

  • Update to version 11.6.11: Features and enhancements:

    • Alerting: Add limits for the size of expanded notification templates
    • Correlations: Remove support for org_id=0 Security:
    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)

  • Update to version 11.6.10: Features and enhancements:

    • API: Add missing scope check on dashboards
    • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
    • Alerting: Fix a race condition panic in ResetStateByRuleUID

  • Update to version 11.6.9: Features and enhancements:

    • Plugins: Add PluginContext to plugins when scenes is disabled Bug fixes:
    • Alerting: Fix contacts point issues

  • Update to version 11.6.8: Bug fixes:

    • Alerting: Fix unmarshalling of GettableStatus to include time intervals

  • Update to version 11.6.7: Bug fixes:

    • Auth: Fix render user OAuth passthrough
    • LDAP Authentication: Fix URL to propagate username context as parameter
    • Plugins: Dependencies do not inherit parent URL for preinstall
    • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)

  • Update to version 11.6.6: Bug fixes:

    • Alerting: Fix copying of recording rule fields
    • Fix redirection after login when Grafana is served from subpath

  • Update to version 11.6.5: Features and enhancements:

    • Alerting: Bump alerting package to include change to NewTLSClient

  • Update to version 11.6.4: Features and enhancements:

    • StateTimeline: Add endTime to tooltip
    • Unified storage: Respect GF_DATABASE_URL override Bug fixes:
    • Alerting: Fix group interval override when adding new rules
    • Azure: Fix legend formatting
    • Azure: Fix resource name determination in template variable queries
    • Graphite: Fix annotation queries
    • Graphite: Fix date mutation
    • Graphite: Fix nested variable interpolation for repeated rows

  • Update to version 11.6.3: Security:

    • Fixes CVE-2025-3415

  • Update to version 11.6.2: Bug fixes:

    • Dashboard: Fixes issue with row repeats and first row
    • Graphite: Ensure template variables are interpolated correctly
    • Graphite: Fix Graphite series interpolation
    • Prometheus: Fix semver import path

  • Update to version 11.6.1: Features and enhancements:

    • DashboardScenePage: Correct slug in self referencing data links
    • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
    • Prometheus: Add support for cloud partners Prometheus data sources Bug fixes:
    • Alertmanager: Add Role-Based Access Control via reqAction Field
    • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
    • InfluxDB: Fix nested variable interpolation
    • LDAP test: Fix page crash
    • Org redirection: Fix linking between orgs

  • Upgrade to version 11.6.0: Features and enhancements:

    • Visualisations: One click links and actions
    • Annotations: Add cron syntax support
    • WebGL-powered geomaps for better performance
    • Alerting: Add alert rule version history Security:
    • API keys: Migrate API keys to service accounts at startup

  • CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)

  • CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)

  • CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)

  • CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)

  • Use forked wire from Grafana repository instead of external package (jsc#PED-14178).

  • Update to version 11.5.10: Security:

    • CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
    • CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) Features and enhancements:
    • Update to Go 1.25
    • Update to golang.org/x/net v0.45.0 Bug fixes:
    • Auth: Fix render user OAuth…
Record
openSUSE-SU-2026:20654-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20940-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

  • Update to version 11.6.14+security-04: Security:

    • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
    • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
    • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
    • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
    • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
    • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
    • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
    • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
    • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
    • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

  • CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

  • CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

  • CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

  • CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

  • Update to version 11.6.14+security-01: Security:

    • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

  • Update to version 11.6.14: Security:

    • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Update to version 11.6.13: Enhancement:

    • Wire the public dashboard service to the HTTP server

  • Update to version 11.6.12: Enhancement:

    • Update authentication redirect logic Bug fix:
    • Fix single panel render with variable references
Record
openSUSE-SU-2026:20940-1
Updated
2026-11-02
OSVSUSE-SU-2025:01987-1 No score

Security update for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

  • Security issues fixed:

    • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
    • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

  • Other bugs fixes from version 2.53.4:

    • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
    • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

  • Security issues fixed:

    • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
    • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

  • Other changes from version 0.26.0:

    • Changes:
      • Replace go-kit/log with log/slog module.
    • Features:
      • Add metric to record tls ciphersuite negotiated during handshake.
      • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
    • Enhancement:
      • Add stale workflow to start sync with stale.yaml in Prometheus.
    • Bug fixes:
      • Only register grpc TLS metrics on successful handshake.

  • Other changes from version 0.25.0:

    • Features:
      • Allow to get Probe logs by target.
      • Log errors from probe.
    • Bug fixes:
      • Prevent logging confusing error message.
      • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

  • Security issues fixed:

    • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
    • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
    • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
    • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
    • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
    • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
    • CVE-2024-9264: SQL Expressions (bsc#1231844)
    • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
    • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

  • Potential breaking changes in version 11.5.0:

    • Loki: Default to /labels API with query param instead of /series API.

  • Potential breaking changes in version 11.0.1:

    • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

  • Potential breaking changes in version 11.0.0:

    • AngularJS support is turned off by default.
    • Legacy alerting is entirely removed.
    • Subfolders cause very rare issues with folders which have slashes in their names.
    • The input data source is removed.
    • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
    • The URL which is generated when viewing an individual repeated panel has changed.
    • React Router is deprecated.
    • The grafana/e2e testing tool is deprecated.

  • This update brings many new features, enhancements and fixes highlighted at:

golang-github-prometheus-node_exporter was updated to version 1.9.1:

  • Security issues fixed:

    • CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)

  • Other changes from version 1.9.1: …

Record
SUSE-SU-2025:01987-1
Updated
2026-11-02
OSVSUSE-SU-2025:01989-1 No score

Security update for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

  • Security issues fixed:

    • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
    • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

  • Other bugs fixes from version 2.53.4:

    • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
    • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

  • Security issues fixed:

    • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
    • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

  • Other changes from version 0.26.0:

    • Changes:
      • Replace go-kit/log with log/slog module.
    • Features:
      • Add metric to record tls ciphersuite negotiated during handshake.
      • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
    • Enhancement:
      • Add stale workflow to start sync with stale.yaml in Prometheus.
    • Bug fixes:
      • Only register grpc TLS metrics on successful handshake.

  • Other changes from version 0.25.0:

    • Features:
      • Allow to get Probe logs by target.
      • Log errors from probe.
    • Bug fixes:
      • Prevent logging confusing error message.
      • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

  • Security issues fixed:

    • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
    • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
    • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
    • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
    • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
    • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
    • CVE-2024-9264: SQL Expressions (bsc#1231844)
    • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
    • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

  • Potential breaking changes in version 11.5.0:

    • Loki: Default to /labels API with query param instead of /series API.

  • Potential breaking changes in version 11.0.1:

    • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

  • Potential breaking changes in version 11.0.0:

    • AngularJS support is turned off by default.
    • Legacy alerting is entirely removed.
    • Subfolders cause very rare issues with folders which have slashes in their names.
    • The input data source is removed.
    • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
    • The URL which is generated when viewing an individual repeated panel has changed.
    • React Router is deprecated.
    • The grafana/e2e testing tool is deprecated.

  • This update brings many new features, enhancements and fixes highlighted at:

Record
SUSE-SU-2025:01989-1
Updated
2026-11-02
OSVSUSE-SU-2025:01991-1 No score

Security update for grafana

This update for grafana fixes the following issues:

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

  • Security issues fixed:

    • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
    • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
    • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
    • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
    • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
    • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
    • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
    • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
    • CVE-2024-9264: SQL Expressions (bsc#1231844)
    • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
    • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

  • Potential breaking changes in version 11.5.0:

    • Loki: Default to /labels API with query param instead of /series API.

  • Potential breaking changes in version 11.0.1:

    • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

  • Potential breaking changes in version 11.0.0:

    • AngularJS support is turned off by default.
    • Legacy alerting is entirely removed.
    • Subfolders cause very rare issues with folders which have slashes in their names.
    • The input data source is removed.
    • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
    • The URL which is generated when viewing an individual repeated panel has changed.
    • React Router is deprecated.
    • The grafana/e2e testing tool is deprecated.

  • This update brings many new features, enhancements and fixes highlighted at:

Record
SUSE-SU-2025:01991-1
Updated
2026-11-02
OSVSUSE-SU-2026:0383-1 No score

Security update for rekor

This update for rekor fixes the following issues:

Security fixes:

  • CVE-2025-58058: Fixed github.com/ulikunitz/xz leaks memory (bsc#1248910)
  • CVE-2025-29923: Fixed potential out of order responses when CLIENT SETINFO times out during connection establishment (bsc#1241153)

Other fixes:

  • Update to version 1.4.3
  • Update to version 1.4.2
  • Update to version 1.4.1 (jsc#SLE-23476)
Record
SUSE-SU-2026:0383-1
Updated
2026-11-02
OSVSUSE-SU-2026:2243-1 No score

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Security Fixes:

    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

  • Backward Compatibility and packaging changes:

    • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
    • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

  • Version 1.10.2:

    • Fixed typo in Zswap metric name (meminfo)

  • Version 1.10.1:

    • Fixed mount points being collected multiple times (filesystem)
    • Refactored mountinfo parsing (bsc#1261810)
    • Added Zswap/Zswapped metrics (meminfo)

  • Version 1.10.0:

    • New collectors: PCIe devices, swaps
    • Added systemd virtualization metrics, AIX metrics
    • WiFi packet metrics, additional PCIe and TLB metrics
    • Changed mdadm to use sysfs, added erofs to excluded filesystems
    • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bump google.golang.org/grpc to version 1.79.3
    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bump rollup to version 4.59.0

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

  • Security Fixes:

    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

  • Highlights of other changes and bug fixes:

    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references

spacecmd:

  • Version…
Record
SUSE-SU-2026:2243-1
Updated
2026-11-02
OSVSUSE-SU-2026:2258-1 No score

Security update for grafana

This update for grafana to version to 11.6.14+security01 fixes the following issues:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references
Record
SUSE-SU-2026:2258-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/redis/go-redis/v9
Go
 9.6.0b1 up to 9.6.3
9.6.3
github.com/redis/go-redis/v9
Go
 9.5.1 up to 9.5.5
9.5.5
github.com/redis/go-redis/v9
Go
 9.7.0-beta.1 to 9.7.1
9.7.3
telegraf
Azure Linux:3
 before 1.31.0-27
1.31.0-27
keda
Azure Linux:3
 before 2.14.1-5
2.14.1-5
github.com/redis/go-redis/v9
Go
 9.7.0-beta.1 up to 9.7.3
9.7.3
github.com/redis/go-redis
Go
 All versions None known
github.com/redis/go-redis/v7
Go
 All versions None known
github.com/redis/go-redis/v8
Go
 All versions None known
github.com/redis/go-redis/v9
Go
 before 9.6.3
9.6.3
Show 29 moreShow less
Affected packages
PackageAffectedFixed
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 0.26.0-1.31.2
0.26.0-1.31.2
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 1.9.1-1.36.2
1.9.1-1.36.2
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 2.53.4-1.60.2
2.53.4-1.60.2
grafana
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 11.5.5-1.79.2
11.5.5-1.79.2
prometheus-blackbox_exporter
SUSE:Manager Client Tools 12
From an advisory covering 8 CVEs
 before 0.26.0-1.27.1
0.26.0-1.27.1
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 8 CVEs
 before 1.9.1-1.36.2
1.9.1-1.36.2
golang-github-prometheus-node_exporter
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 8 CVEs
 before 1.9.1-1.36.2
1.9.1-1.36.2
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 15
From an advisory covering 8 CVEs
 before 2.53.4-150000.3.62.2
2.53.4-150000.3.62.2
grafana
SUSE:Manager Client Tools 15
From an advisory covering 8 CVEs
 before 11.5.5-150000.1.79.1
11.5.5-150000.1.79.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools 15
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
prometheus-blackbox_exporter
SUSE:Manager Proxy Module 4.3
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
prometheus-blackbox_exporter
openSUSE:Leap 15.6
From an advisory covering 8 CVEs
 before 0.26.0-150000.1.27.1
0.26.0-150000.1.27.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 8 CVEs
 before 11.5.5-150200.3.72.2
11.5.5-150200.3.72.2
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 8 CVEs
 before 11.5.5-150200.3.72.2
11.5.5-150200.3.72.2
grafana
openSUSE:Leap 15.6
From an advisory covering 8 CVEs
 before 11.5.5-150200.3.72.2
11.5.5-150200.3.72.2
rekor
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 1.4.3-150400.4.28.1
1.4.3-150400.4.28.1
rekor
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.4.3-150400.4.28.1
1.4.3-150400.4.28.1
golang-github-go-redis-redis
Ubuntu:18.04:LTS
 All versions, plus listed versions
6.7.2-16.7.4-16.9.2-2
 None known
golang-github-go-redis-redis
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.15.0-1
 None known
golang-github-go-redis-redis
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.15.0-16.15.0-2
 None known
golang-github-go-redis-redis
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.15.0-2
 None known
golang-github-go-redis-redis
Ubuntu:25.10
 All versions, plus listed versions
6.15.0-2
 None known
golang-github-go-redis-redis
Ubuntu:26.10
 All versions, plus listed versions
6.15.0-26.15.0-4
 None known
golang-github-go-redis-redis
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.15.0-2
 None known
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 30 CVEs
 before 0.0.20250327T184518-1.1
0.0.20250327T184518-1.1
grafana
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 11.5.4-1.1
11.5.4-1.1
rekor
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.4.1-1.1
1.4.1-1.1
grafana
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 11.6.14+security04-bp160.1.1
11.6.14+security04-bp160.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-29923 is a low vulnerability (CVSS 3.7) in Redis Go-redis, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in github.com/redis/go-redis/v9 9.6.3.

References

Show 166 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open