CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

A vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

A vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line,…

Root has patched CVE-2025-47914 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

This update for trivy fixes the following issues:

• Update to version 0.68.2:
  • release: v0.68.2 [release/v0.68] (#9950)
  • fix(deps): bump alpine from 3.22.1 to 3.23.0 [backport: release/v0.68] (#9949)
  • ci: enable check-latest for setup-go [backport: release/v0.68] (#9946)

These are all security issues fixed in the git-bug-0.10.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cheat-4.4.2-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.68.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for git-bug fixes the following issues:

Changes in git-bug:

• Revendor to include fixed version of depending libraries:

  • GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade golang.org/x/crypto to v0.43.0
  • GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade github.com/go-viper/mapstructure/v2 to v2.4.0
  • GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous
  • GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade github.com/cloudflare/circl to v1.6.1
  • GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade golang.org/x/crypto/ssh to v0.45.0
  • GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade golang.org/x/crypto/ssh/agent to v0.45.0

• Revendor to include golang.org/x/net/html v 0.45.0 to prevent possible DoS by various algorithms with quadratic complexity when parsing HTML documents (bsc#1251463, CVE-2025-47911 and bsc#1251664, CVE-2025-58190).

Update to version 0.10.1:

• cli: ignore missing sections when removing configuration (ddb22a2f)

Update to version 0.10.0:

• bridge: correct command used to create a new bridge (9942337b)
• web: simplify header navigation (7e95b169)
• webui: remark upgrade + gfm + syntax highlighting (6ee47b96)
• BREAKING CHANGE: dev-infra: remove gokart (89b880bd)

Update to version 0.10.0:

• bridge: correct command used to create a new bridge (9942337b)
• web: simplify header navigation (7e95b169)
• web: remark upgrade + gfm + syntax highlighting (6ee47b96)

Update to version 0.9.0:

• completion: remove errata from string literal (aa102c91)
• tui: improve readability of the help bar (23be684a)

Update to version 0.8.1+git.1746484874.96c7a111:

• docs: update install, contrib, and usage documentation (#1222)
• fix: resolve the remote URI using url.*.insteadOf (#1394)
• build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)
• chore: gofmt simplify gitlab/export_test.go (#1392)
• fix: checkout repo before setting up go environment (#1390)
• feat: bump to go v1.24.2 (#1389)
• chore: update golang.org/x/net (#1379)
• fix: use -0700 when formatting time (#1388)
• fix: use correct url for gitlab PATs (#1384)
• refactor: remove depdendency on pnpm for auto-label action (#1383)
• feat: add action: auto-label (#1380)
• feat: remove lifecycle/frozen (#1377)
• build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)
• feat: support new exclusion label: lifecycle/pinned (#1375)
• fix: refactor how gitlab title changes are detected (#1370)
• revert: "Create Dependabot config file" (#1374)
• refactor: rename //:git-bug.go to //:main.go (#1373)
• build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)
• fix: set GitLastTag to an empty string when git-describe errors (#1355)
• chore: update go-git to v5@masterupdate_mods (#1284)
• refactor: Directly swap two variables to optimize code (#1272)
• Update README.md Matrix link to new room (#1275)

• Update to version 0.8.0+git.1742269202.0ab94c9:

  • deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)

• Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494, CVE-2025-22869).

• Add missing Requires to completion subpackages.

Update to version 0.8.0+git.1733745604.d499b6e:

• fix typos in docs (#1266)
• build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)

• bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).

This update for cheat fixes the following issues:

• Security:

  • CVE-2025-47913: Fix client process termination (bsc#1253593)
  • CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)
  • CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)
  • Replace golang.org/x/crypto=golang.org/x/[email protected]
  • Replace golang.org/x/net=golang.org/x/[email protected]
  • Replace golang.org/x/sys=golang.org/x/[email protected]

• Packaging improvements:

  • Drop Requires: golang-packaging. The recommended Go toolchain dependency expression is BuildRequires: golang(API) >= 1.x or optionally the metapackage BuildRequires: go
  • Use BuildRequires: golang(API) >= 1.19 matching go.mod
  • Build PIE with pattern that may become recommended procedure: %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build A go toolchain buildmode default config would be preferable but none exist at this time.
  • Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
  • Remove go build -o output binary location and name. Default binary has the same name as package of func main() and is placed in the top level of the build directory.
  • Add basic %check to execute binary --help

• Packaging improvements:

  • Service go_modules replace dependencies with CVEs
  • Replace github.com/cloudflare/circl=github.com/cloudflare/[email protected] Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm
  • Replace golang.org/x/net=golang.org/x/[email protected] Fixes GO-2025-3503 CVE-2025-22870
  • Replace golang.org/x/crypto=golang.org/x/[email protected] Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8 Fixes GO-2025-3487 CVE-2025-22869
  • Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/[email protected] Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4 Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
  • Service tar_scm set mode manual from disabled
  • Service tar_scm create archive from git so we can exclude vendor directory upstream committed to git. Committed vendor directory contents have build issues even after go mod tidy.
  • Service tar_scm exclude dir vendor
  • Service set_version set mode manual from disabled
  • Service set_version remove param basename not needed

These are all security issues fixed in the apptainer-1.4.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mcphost-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubeshark-cli-53.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rz-pm-0.3.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the k3sup-0.13.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kumactl-3.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ssm-agent-3.3.5678.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for buildah fixes the following issues:

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed non validated message size causing a panic due to an out of bounds read (bsc#1254054)
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253598)
• CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1253096)

Other fixes:

• Updated to version 1.39.5.

This update for elemental-register, elemental-toolkit fixes the following issues:

elemental-register was updated to 1.8.1:

Changes on top of v1.8.1:

• Update headers to 2026
• Update questions to include SL Micro 6.2

Update to v1.8.1:

• Install yip config files in before-install step
• Bump github.com/rancher-sandbox/go-tpm and its dependencies This includes few CVE fixes:
  • bsc#1241826 (CVE-2025-22872)
  • bsc#1241857 (CVE-2025-22872)
  • bsc#1251511 (CVE-2025-47911)
  • bsc#1251679 (CVE-2025-58190)

elemental-toolkit was updated to v2.3.2:

• Bump golang.org/x/crypto library This includes few CVE fixes:
  • bsc#1241826 (CVE-2025-22872)
  • bsc#1241857 (CVE-2025-22872)
  • bsc#1251511 (CVE-2025-47911)
  • bsc#1251679 (CVE-2025-58190)
  • bsc#1253581 (CVE-2025-47913)
  • bsc#1253901 (CVE-2025-58181)
  • bsc#1254079 (CVE-2025-47914)

This update for podman fixes the following issues:

Changes in podman:

• Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

• CVE-2025-47914: Fixed golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253993)

• CVE-2025-47913: Fixed golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253542):

• CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed runc: Container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1252376):

• CVE-2025-9566: Fixed that podman kube play command may overwrite host files (bsc#1249154):

This update for docker-compose fixes the following issues:

• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253584).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254041).
• CVE-2025-62725: OCI compose artifacts can be used to escape the cache directory and overwrite arbitrary files (bsc#1252752).

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix CVE-2026-34986 (bsc#1262956) * github.com/go-jose/go-jose/[email protected] CVE-2026-33186 GO-2026-4762 (bsc#1260311) * google.golang.org/[email protected] CVE-2026-24137 GO-2026-4358 (bsc#1264177) * github.com/sigstore/[email protected] Fix fallout: github.com/moby/[email protected] github.com/containers/image/v5=github.com/containers/image/[email protected]

• Fix HTML parser misimplementation of a part of the HTML specification for table related tags (CVE-2025-58190, GO-2026-4441, bsc#1258048).

• Fix issue where the HTML parser takes a very long time or even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).

• Update ot 1.4.5

  • Fix for moderate severity GO-2025-4176 / CVE-2025-65105 / GHSA-j3rw-fx6g-q46j (bsc#1255462): Ineffective application of selinux / apparmor --security option. Updates of a few dependent go libraries for related security fixes.
  • Other fix Run FUSE processes in a separate process group. This detaches them from the main process so they don't receive signals such as interrupts sent to a terminal there. This was not a problem with interactive shells because they start their own group, but was a problem with some programs with interactive Read/Eval/Print/Loops such as python. An interrupt there would kill the FUSE processes.

• From 1.4.4

  • By applying patches to the bundled fuse2fs, allow again the possibility of using a non-writable ext3 image file as an overlay. Fixes regression introduced in 1.4.3.
  • If an overlay or bound data image is asked to be mounted writable but the user has no write access to the image, show a warning message instead of silently switching to readonly.
  • Avoid a fatal error when starting fakeroot from suid mode while in an NFS directory.
  • Fix 32-bit builds which were accidentally broken by a library upgrade that was done for a minor security issue.

• Fix CVEs:

  • GO-2025-4135 - CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent.
  • GO-2025-4134 - CVE-2025-58181 - bsc#1253924 Unbounded memory consumption in golang.org/x/crypto/ssh.
  • GO-2025-4116 - CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent.
  • GO-2025-3595 - CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net.
  • GO-2025-3503 - CVE-2025-22870 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.
  • GO-2025-3487 - CVE-2025-22869 Potential denial of service in golang.org/x/crypto.
  • GO-2025-3485 - CVE-2025-27144 DoS in go-jose Parsing in github.com/go-jose/go-jose.
  • GO-2025-3754 - CVE-2025-8556 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl.

• No need for binutils-gold for aarch64

• Update to 1.4.3

  • Corrected the mconfig -s option for statically building apptainer and starter binaries.
  • Resolved an issue where the Makefile generated by mconfig -b failed when the build directory was not a subdirectory of the Apptainer source code.
  • Fixed %files in definition files to correctly copy symlinks pointing above the destination directory but within the destination stage root filesystem.
  • Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was corrected to libnvoptix.so).
  • Prevented timeouts during cleanup after building gocryptfs-encrypted SIF files.
  • Fixed a bug that prevented build with --passphrase or --pem-path (without --encrypt) from implying fakeroot.
  • Resolved a hang when copying files between build stages while using suid mode without user namespaces.
  • Fixed issues with running and building containers of different architectures than the host via binfmt_misc when using rootless fakeroot.
  • Corrected "target: no such file or directory" errors when …

This update for mcphost fixes the following issues

• CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1265274).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1265275).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253952).
• CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260224).

Changes for mcphost:

• Updated to version 0.34.0

• Features:

• Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)
• Add Google Vertex AI support for Claude models
• Add new models.

• Fixes:

• Eliminate escape sequence leak from spinner tea.Program instances.
• Fix anthropic api issue.
• Convert JSON Schema draft-07 exclusive bounds to draft-04 format.

• Upgrade all dependencies to latest versions, resolve security issues and to obtain Go 1.26 compatibility.

This update for trivy fixes the following issues:

Update to version 0.68.2:

Security fixes:

• CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).
• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).
• CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).
• CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).
• CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).
• CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).
• CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).
• CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).
• CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251547).

Other fixes:

• Update installation.md (#8979)
• chore(alpine): add EOL date for Alpine 3.21 (#8221)
• chore(alpine): add EOL date for Alpine 3.22 (#8992)
• chore(cli): Remove Trivy Cloud (#9847)
• chore(deps): Bump trivy-checks (#7819)
• chore(deps): Bump trivy-checks (#8310)
• chore(deps): Bump trivy-checks (#8619)
• chore(deps): Bump trivy-checks (#8934)
• chore(deps): Bump trivy-checks to v1.7.1 (#8467)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• chore(deps): Switch to go-viper/mapstructure (#9579)
• chore(deps): Update trivy-checks (#8798)
• chore(deps): Upgrade trivy-checks (#8018)
• chore(deps): bump Go to v1.23.5 (#8341)
• chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 (#8105)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 (#8140)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
• chore(deps): bump alpine from…

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• golang.org/x/crypto/ssh: Fixed multiple issues: CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)

• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (boo#1266596).

• Update to version 6.6.2

  • Improve git default branch handling

• CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)

• Switch to go1.25 as required by update go image library.

• Update to version 6.6.0

  • Various bug fixes and performance improvements

• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258591).

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254023).

• CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253864).

• CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).

• Update to version 6.5.1

  • Fix team deletion not working
  • Chat attachments improvements
  • Miscellaneous bugfixes

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for buildah fixes the following issues:

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed out of bounds read caused by non validated message size (bsc#1254054)
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253598)

This update for podman fixes the following issues:

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed SSH Agent that could cause a panic due to an out-of-bounds read with non-validated message sizes (bsc#1253993)

This update for buildah fixes the following issues:

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed out of bounds read caused by non validated message size (bsc#1254054)
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253598)

This update for podman fixes the following issues:

• CVE-2025-47914: Fixed ssh-agent that could cause a panic due to an out-of-bounds read with non validated message size (bsc#1253993)

This update for podman fixes the following issues:

• CVE-2025-47914: Fixed ssh-agent that could cause a panic due to an out-of-bounds read with non validated message size (bsc#1253993)

This update for apptainer fixes the following issues:

Security fixes:

• CVE-2024-45310: Fixed runc being tricked into creating empty files/directories on host (bsc#1257432)
• CVE-2025-65105: Fixed security bypass due to disabling security options (bsc#1255462)
• CVE-2025-47914: Fixed malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent (bsc#1253967)
• CVE-2025-58181: Fixed unbounded memory consumption in golang.org/x/crypto/ssh (bsc#1253784)
• CVE-2025-47913: Fixed potential denial of service in golang.org/x/crypto/ssh/agent (bsc#1253506)
• CVE-2025-22872: Fixed incorrect Neutralization of Input During Web Page Generation in x/net (bsc#1241710)
• CVE-2025-22870: Fixed HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (bsc#1238611)
• CVE-2025-22869: Fixed potential denial of service in golang.org/x/crypto (bsc#1239322)
• CVE-2025-27144: Fixed DoS in go-jose Parsing in github.com/go-jose/go-jose (bsc#1237608)
• CVE-2025-8556: Fixed missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl

Other fixes:

• Update to 1.4.5

This update for podman fixes the following issues:

• CVE-2025-47914: lack of message size validation when SSH Agent server is processing new identity requests can lead to out-of-bounds read and an application panic (bsc#1253993).
• CVE-2025-47913: receiving an SSH_AGENT_SUCCESS reply when the SSH client is expecting a typed response can lead to the early termination of the client process (bsc#1253542).

This update for buildah fixes the following issues:

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed non validated message size causing a panic due to an out of bounds read (bsc#1254054)
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253598)
• CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1253096)

Other fixes:

• Updated to version 1.39.5.

This update for elemental-register, elemental-toolkit fixes the following issues:

elemental-register was updated to 1.8.1:

Changes on top of v1.8.1:

• Update headers to 2026
• Update questions to include SL Micro 6.2

Update to v1.8.1:

• Install yip config files in before-install step
• Bump github.com/rancher-sandbox/go-tpm and its dependencies This includes few CVE fixes:
  • bsc#1241826 (CVE-2025-22872)
  • bsc#1241857 (CVE-2025-22872)
  • bsc#1251511 (CVE-2025-47911)
  • bsc#1251679 (CVE-2025-58190)

elemental-toolkit was updated to v2.3.2:

• Bump golang.org/x/crypto library This includes few CVE fixes:
  • bsc#1241826 (CVE-2025-22872)
  • bsc#1241857 (CVE-2025-22872)
  • bsc#1251511 (CVE-2025-47911)
  • bsc#1251679 (CVE-2025-58190)
  • bsc#1253581 (CVE-2025-47913)
  • bsc#1253901 (CVE-2025-58181)
  • bsc#1254079 (CVE-2025-47914)

This update for elemental-toolkit, elemental-operator fixes the following issues:

elemental-operator:

• Update to version 1.6.10:

  • Remove 'latest' tag as this overlaps with the latest branch
  • Bump github.com/rancher-sandbox/go-tpm and its dependencies This bump includes fixes to some CVEs:
    • bsc#1241826 (CVE-2025-22872)
    • bsc#1241857 (CVE-2025-22872)
    • bsc#1251511 (CVE-2025-47911)
    • bsc#1251679 (CVE-2025-58190)

elemental-toolkit:

• Update to version 2.1.5:

  • Update headers for new year 2026
  • Disable selinux in installer media

• Update to version 2.1.4:

  • Remove leftovers in installer integration test

  • Bump to build against go 1.24

  • Bump golang.org/x/crypto library This bump includes fixes to some CVEs:

    • bsc#1241826 (CVE-2025-22872)
    • bsc#1241857 (CVE-2025-22872)
    • bsc#1251511 (CVE-2025-47911)
    • bsc#1251679 (CVE-2025-58190)
    • bsc#1253581 (CVE-2025-47913)
    • bsc#1253901 (CVE-2025-58181)
    • bsc#1254079 (CVE-2025-47914)