CVE-2025-58058

Summary

It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification.

Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done.

Mitigations

The release v0.5.15 includes following mitigations:

• The ReaderConfig DictCap field is now interpreted as a limit for the dictionary size.
• The default is 2 Gigabytes - 1 byte (2^31-1 bytes).
• Users can check with the [Reader.Header] method what the actual values are in their LZMA files and set a smaller limit using ReaderConfig.
• The dictionary size will not exceed the larger of the file size and the minimum dictionary size. This is another measure to prevent huge memory allocations for the dictionary.
• The code supports stream sizes only up to a pebibyte (1024^5).

Note that the original v0.5.14 version had a compiler error for 32 bit platforms, which has been fixed by v0.5.15.

Methods affected

Only software that uses lzma.NewReader or lzma.ReaderConfig.NewReader is affected. There is no issue for software using the xz functionality.

I thank @GregoryBuligin for his report, which is provided below.

Summary

When unpacking a large number of LZMA archives, even in a single goroutine, if the first byte of the archive file is 0 (a zero byte added to the beginning), an error writeMatch: distance out of range occurs. Memory consumption spikes sharply, and the GC clearly cannot handle this situation.

Details

Judging by the error writeMatch: distance out of range, the problems occur in the code around this function. https://github.com/ulikunitz/xz/blob/c8314b8f21e9c5e25b52da07544cac14db277e89/lzma/decoderdict.go#L81

PoC

Run a function similar to this one in 1 or several goroutines on a multitude of LZMA archives that have a 0 (a zero byte) added to the beginning.

const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
	file, err := os.Open(lzmaFile)
	if err != nil {
		return err
	}
	defer file.Close()

	reader, err := lzma.NewReader(bufio.NewReader(file))
	if err != nil {
		return err
	}

	tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix)
	if err != nil {
		return err
	}
	defer func() {
		tmpFile.Close()
		_ = os.Remove(tmpFile.Name())
	}()

	sha256Hasher := sha256.New()
	multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

	if _, err = io.Copy(multiWriter, reader); err != nil {
		return err
	}

	unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
	unpackDir := filepath.Join(
		ProjectLocalPath, unpackHash[:2],
	)
	_ = os.MkdirAll(unpackDir, DirPerm)

	unpackPath := filepath.Join(unpackDir, unpackHash)

	return os.Rename(tmpFile.Name(), unpackPath)
}

Impact

Servers with a small amount of RAM that download and unpack a large number of unverified LZMA archives

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz

These are all security issues fixed in the tailscale-1.86.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rekor-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sbctl-0.17-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the regclient-0.9.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the warewulf4-4.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.66.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250917T170349-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.11.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the hauler-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

• Update to version 4.6.4:

  • v4.6.4 release updates
  • Convert disk booleans from wwbool to *bool which allows bools in disk to be set to false via command line (bsc#1248768)
  • Update NetworkManager Overlay
    • Disable ipv4 in NetworkManager if no address or route is specified
  • fix(wwctl): Create overlay edit tempfile in tmpdir
  • Add default for systemd name for warewulf in warewulf.conf
  • Atomic overlay file application in wwclient
  • Simpler names for overlay methods
  • Fix warewulfd api behavior when deleting distribution overlay

• Update to version 4.6.3:

  • v4.6.3 release
  • IPv6 iPXE support
  • Fix a syntax error in the RPM specfile
  • Fix a race condition in wwctl overlay edit
  • Fixed handling of comma-separated mount options in fstab and ignition overlays
  • Move reexec.Init() to beginning of wwctl
  • Add documentation for using tmpfs to distribute across numa nodes
  • added warewuld configure option
  • Fix wwctl upgrade nodes to handle kernel argument lists (bsc#1227686 bsc#1227465)
  • Address copilot review from #1945
  • Refactor wwapi tests for proper isolation
  • Bugfix: cloning a site overlay when parent dir does not exist
  • Clone to a site overlay when adding files in wwapi
  • Consolidated createOverlayFile and updateOverlayFile to addOverlayFile
  • Support for creating and updating overlay file in wwapi
  • Only return overlay files that refer to a path within the overlay
  • add overlay file deletion support
  • DELETE /api/overlays/{id}?force=true can delete overlays in use
  • Restore idempotency of PUT /api/nodes/{id}
  • Simplify overlay mtime api and add tests
  • add node overlay buildtime
  • Improved netplan support
  • Rebuild overlays for discovered nodes
  • Restrict userdocs from building during pr when not modified
  • Update to v4.6.2 GitHub release notes

This update for alloy fixes the following issues:

• CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).
• CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).

This update for trivy fixes the following issues:

Changes in trivy:

Update to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):

• fix: Use fetch-level: 1 to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)
• fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)
• fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)
• fix: add buildInfo for BlobInfo in rpc package [backport: release/v0.67] (#9615)
• fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)
• fix(vex): don't suppress vulns for packages with infinity loop (#9465)
• fix(aws): use BuildableClient insead of xhttp.Client (#9436)
• refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)
• docs: clarify inline ignore limitations for resource-less checks (#9537)
• fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)
• fix(misconf): handle tofu files in module detection (#9486)
• feat(seal): add seal support (#9370)
• docs: fix modules path and update code example (#9539)
• fix: close file descriptors and pipes on error paths (#9536)
• feat: add documentation URL for database lock errors (#9531)
• fix(db): Dowload database when missing but metadata still exists (#9393)
• feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)
• fix(misconf): unmark cty values before access (#9495)
• feat(cli): change --list-all-pkgs default to true (#9510)
• fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)
• refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)
• refactor: remove google/wire dependency and implement manual DI (#9509)
• chore(deps): bump the aws group with 6 updates (#9481)
• chore(deps): bump the common group across 1 directory with 24 updates (#9507)
• fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)
• docs: move info about detection priority into coverage section (#9469)
• feat(sbom): added support for CoreOS (#9448)
• fix(misconf): strip build metadata suffixes from image history (#9498)
• feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)
• docs: Fix typo in terraform docs (#9492)
• feat(redhat): add os-release detection for RHEL-based images (#9458)
• ci(deps): add 3-day cooldown period for Dependabot updates (#9475)
• refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)
• fix(vuln): compare nuget package names in lower case (#9456)
• chore: Update release flow to include chocolatey (#9460)
• docs: document eol supportability (#9434)
• docs(report): add nuanses about secret/license scanner in summary table (#9442)
• ci: use environment variables in GitHub Actions for improved security (#9433)
• chore: bump Go to 1.24.7 (#9435)
• fix(nodejs): use snapshot string as Package.ID for pnpm packages (#9330)
• ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)

Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):

• chore(deps): bump the aws group with 7 updates (#9419)
• refactor(secret): clarify secret scanner messages (#9409)
• fix(cyclonedx): handle multiple license types (#9378)
• fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
• test: add HTTP basic authentication to git test server (#9407)
• fix(sbom): add support for file component type of CycloneDX (#9372)
• fix(misconf): ensure module source is known (#9404)
• ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
• fix: create temp file under composite fs dir (#9387)
• chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
• refactor: switch to stable azcontainerregistry SDK package (#9319)
• chore(deps): bump the common…

This update for hauler fixes the following issues:

• Update to version 1.3.1 (bsc#1251516, CVE-2025-47911, bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190, bsc#1248937, CVE-2025-58058):

  • bump github.com/containerd/containerd (#474)
  • another fix to tests for new tests (#472)
  • fixed typo in testdata (#471)
  • fixed/cleaned new tests (#470)
  • trying a new way for hauler testing (#467)
  • update for cosign v3 verify (#469)
  • added digests view to info (#465)
  • bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457)
  • update oras-go to v1.2.7 for security patches (#464)
  • update cosign to v3.0.2+hauler.1 (#463)
  • fixed homebrew directory deprecation (#462)
  • add registry logout command (#460)

• Update to version 1.3.0:

  • bump the go_modules group across 1 directory with 2 updates (#455)
  • upgraded versions/dependencies/deprecations (#454)
  • allow loading of docker tarballs (#452)
  • bump the go_modules group across 1 directory with 2 updates (#449)

• update to 1.2.5 (bsc#1246722, CVE-2025-46569):

  • Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in the go_modules group across 1 directory (CVE-2025-46569)
  • deprecate auth from hauler store copy
  • Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the go_modules group across 1 directory
  • Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group across 1 directory
  • upgraded go and dependencies versions

• Update to version 1.2.5:

  • upgraded go and dependencies versions (#444)
  • Bump github.com/go-viper/mapstructure/v2 (#442)
  • bump github.com/cloudflare/circl (#441)
  • deprecate auth from hauler store copy (#440)
  • Bump github.com/open-policy-agent/opa (#438)

• update to 1.2.4 (CVE-2025-22872, bsc#1241804):

  • Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory
  • minor tests updates

• Update to version 1.2.3:

  • formatting and flag text updates
  • add keyless signature verification (#434)
  • bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
  • add --only flag to hauler store copy (for images) (#429)
  • fix tlog verification error/warning output (#428)

• Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):

  • cleanup new tlog flag typos and add shorthand (#426)
  • default public transparency log verification to false to be airgap friendly but allow override (#425)
  • bump github.com/golang-jwt/jwt/v4 (#423)
  • bump the go_modules group across 1 directory with 2 updates (#422)
  • bump github.com/go-jose/go-jose/v3 (#417)
  • bump github.com/go-jose/go-jose/v4 (#415)
  • clear default manifest name if product flag used with sync (#412)
  • updates for v1.2.0 (#408)
  • fixed remote code (#407)
  • added remote file fetch to load (#406)
  • added remote and multiple file fetch to sync (#405)
  • updated save flag and related logs (#404)
  • updated load flag and related logs [breaking change] (#403)
  • updated sync flag and related logs [breaking change] (#402)
  • upgraded api update to v1/updated dependencies (#400)
  • fixed consts for oci declarations (#398)
  • fix for correctly grabbing platform post cosign 2.4 updates (#393)
  • use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
  • Bump the go_modules group across 1 directory with 2 updates (#385)
  • replace mholt/archiver with mholt/archives (#384)
  • forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
  • cleaned up registry and improved logging (#378)
  • Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)

• bump net/html dependencies (bsc#1235332, CVE-2024-45338)

• Update to version 1.1.1:

  • fixed cli desc for store env var (#374)
  • updated versions for go/k8s/helm (#373)
  • updated version flag to internal/flags (#369)
  • renamed incorrectly named consts (#371)
  • added store env var (#370) …

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for sbctl fixes the following issues:

Changes in sbctl:

• Upgrade the embedded golang.org/x/net to 0.46.0

  • Fixes: bsc#1251399, CVE-2025-47911: various algorithms with quadratic complexity when parsing HTML documents
  • Fixes: bsc#1251609, CVE-2025-58190: excessive memory consumption by 'html.ParseFragment' when processing specially crafted input

• Update to version 0.18:

  • logging: fixup new go vet warning
  • workflows: add cc for cross compile
  • workflow: add sudo to apt
  • workflow: add pcsclite to ci
  • workflow: try enable cgo
  • go.mod: update golang.org/x/ dependencies
  • fix: avoid adding bogus Country attribute to subject DNs
  • sbctl: only store file if we did actually sign the file
  • installkernel: add post install hook for Debian's traditional installkernel
  • CI: missing libpcsclite pkg
  • workflows: add missing depends and new pattern keyword
  • Add yubikey example for create keys to the README
  • Initial yubikey backend keytype support
  • verify: ensure we pass args in correct order

• bsc#1248949 (CVE-2025-58058): Bump xz to 0.5.14

• Update to version 0.17:

  • Ensure we don't wrongly compare input/output files when signing
  • Added --json supprt to sbctl verify
  • Ensure sbctl setup with no arguments returns a helpful output
  • Import latest Microsoft keys for KEK and db databases
  • Ensure we print the path of the file when encountering an invalid PE file
  • Misc fixups in tests
  • Misc typo fixes in prints

• Update to version 0.16:

  • Ensure sbctl reads --config even if /etc/sbctl/sbctl.conf is present
  • Fixed a bug where sbctl would abort if the TPM eventlog contains the same byte multiple times
  • Fixed a landlock bug where enroll-keys --export did not work
  • Fixed a bug where an ESP mounted to multiple paths would not be detected
  • Exporting keys without efivars present work again
  • sbctl sign will now use the saved output path if the signed file is enrolled
  • enroll-keys --append will now work without --force.

• Updates from version 0.15.4:

  • Fixed an issue where sign-all did not report a non-zero exit code when something failed
  • Fixed and issue where we couldn't write to a file with landlock
  • Fixed an issue where --json would print the human readable output and the json
  • Fixes landlock for UKI/bundles by disabling the sandbox feature
  • Some doc fixups that mentioned /usr/share/

This update for tailscale fixes the following issues:

Changes in tailscale:

• Update to version 1.94.0:

  • IS SET and NOT SET have been added as device posture operators
  • India DERP Region City Name updated
  • Custom DERP servers support GCP Certificate Manager
  • Tailscale SSH authentication, when successful, results in LOGIN audit messages being sent to the kernel audit subsystem
  • Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket option is supported on multi-core systems
  • Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale
  • MagicDNS always resolves when using resolv.conf without a DNS manager
  • tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays
  • Identity tokens are automatically generated for workload identities
  • --audience flag added to tailscale up command to support auto generation of ID tokens for workload identity
  • tsnet nodes can host Tailscale Services
  • The tailscale lock status -json command returns tailnet key authority (TKA) data in a stable format
  • Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention
  • Tailscale Services virtual IPs are now automatically accepted by clients across all platforms regardless of the status of the --accept-routes feature

• Update to version 1.94.0:

  • derp/derpserver: add a unique sender cardinality estimate
  • syncs: add means of declare locking assumptions for debug mode
  • cmd/k8s-operator: add support for taiscale.com/http-redirect
  • cmd/k8s-operator fix populateTLSSecret on tests
  • feature/posture: log method and full URL for posture identity requests
  • k8s-operator: Fix typos in egress-pod-readiness.go
  • cmd/tailscale,ipn: add Unix socket support for serve
  • client/systray: change systray to start after graphical.target
  • cmd/k8s-operator: warn if users attempt to expose a headless Service
  • cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  • tsnet: ensure funnel listener cleans up after itself when closed
  • ipn/store/kubestore: don't load write replica certs in memory
  • tsnet: allow for automatic ID token generation

• Update to version 1.92.5:

  • types/persist: omit Persist.AttestationKey based on IsZero
  • disable hardware attestation for kubernetes
  • allow opting out of ACME order replace extension

• Update to version 1.92.4:

  • nothing of importance

• Update to version 1.92.3:

  • WireGuard configuration that occurs automatically in the client, no longer results in a panic

• Update to version 1.92.2:

  • cmd/derper: add GCP Certificate Manager support

• Update to version 1.92.1:

  • fix LocalBackend deadlock when packet arrives during profile switch
  • wgengine: fix TSMP/ICMP callback leak

• Update to version 1.92.0:

  • no changelog provided

• Update to version 1.90.9:

  • tailscaled no longer deadlocks during event bursts
  • The client no longer hangs after wake up

• Update to version 1.90.8:

  • tka: move RemoveAll() to CompactableChonk

• Update to version 1.90.7:

  • wgengine/magicsock: validate endpoint.derpAddr
  • wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  • net/udprelay: replace VNI pool with selection algorithm
  • feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  • feature/relayserver: fix Shutdown() deadlock
  • net/netmon: do not abandon a subscriber when exiting early
  • tka: don't try to read AUMs which are partway through being written
  • tka: rename a mutex to mu instead of single-letter l
  • ipn/ipnlocal: use an in-memory TKA store if FS is unavailable

• Update to version 1.90.6:

  • Routes no longer stall and fail to apply when updated repeatedly in a short period of time
  • Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This …

This update for trivy fixes the following issues:

Update to version 0.68.2:

Security fixes:

• CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).
• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).
• CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).
• CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).
• CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).
• CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).
• CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).
• CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).
• CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251547).

Other fixes:

• Update installation.md (#8979)
• chore(alpine): add EOL date for Alpine 3.21 (#8221)
• chore(alpine): add EOL date for Alpine 3.22 (#8992)
• chore(cli): Remove Trivy Cloud (#9847)
• chore(deps): Bump trivy-checks (#7819)
• chore(deps): Bump trivy-checks (#8310)
• chore(deps): Bump trivy-checks (#8619)
• chore(deps): Bump trivy-checks (#8934)
• chore(deps): Bump trivy-checks to v1.7.1 (#8467)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• chore(deps): Switch to go-viper/mapstructure (#9579)
• chore(deps): Update trivy-checks (#8798)
• chore(deps): Upgrade trivy-checks (#8018)
• chore(deps): bump Go to v1.23.5 (#8341)
• chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 (#8105)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 (#8140)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
• chore(deps): bump alpine from…

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

• updated go-jose to fix CVE-2026-34986 (bsc#1262810)

• chi is fixed in the upstream project

• updating to v4.7.0 with following security fixes

• fixed CVE-2026-39821 (bsc#1266483)
• fixed CVE-2026-33814 (bsc#1265653)

• v4.7.0 with significant changes relative to the v4.6.x series which are:

  • New wwctl unset command
  • Refactored server routes (URLs)
  • New /files/ route for serving individual files and templates
  • Server TLS support
  • Removed support for fetching individual overlays and individual files from overlays
  • Fixed whitespace handling around template functions
  • Security fixes, including updated Go and library versions

• changes from v4.6.5:

  • new wwctl overlay info command
  • fixed wwctl image import --update option
  • cross-arch support for wwclient
  • improved IPv6 support
  • improved support for bonded interfaces
  • renamed debian.interfaces overlay to ifupdown
  • new systemd-networkd overlay
  • warewulf-dracut fixes, including "provision-to-disk" fixes

• remove slurm-overlay package

• fix CVE-2025-69725 (bsc#1258511) by updating chi

• updated to v4.6.5 with following changes:

  • new wwctl overlay info command
  • fixed wwctl image import --update option (bsc#1254470)
  • cross-arch support for wwclient
  • improved IPv6 support
  • improved support for bonded interfaces
  • renamed debian.interfaces overlay to ifupdown
  • new systemd-networkd overlay
  • warewulf-dracut fixes, including "provision-to-disk" fixes

• default to dnsmasq instead of dhcpd and tftp

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20250918T182144 2025-09-18T18:21:44Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3915 CVE-2025-5187 GHSA-4x4m-3c2p-qppc
  • GO-2025-3956 CVE-2025-47906 CVE-2025-47906

• Update to version 0.0.20250917T170349 2025-09-17T17:03:49Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3922 CVE-2025-58058 GHSA-jc7w-c686-c4v9
  • GO-2025-3926 CVE-2025-58158 GHSA-w469-hj2f-jpr5
  • GO-2025-3929 CVE-2025-58157 GHSA-9fvj-xqr2-xwg8
  • GO-2025-3938 CVE-2025-58437 GHSA-j6xf-jwrj-v5qp
  • GO-2025-3939 CVE-2025-7445 GHSA-rcw7-pqfp-735x
  • GO-2025-3940 CVE-2025-58445 GHSA-xh7v-965r-23f7
  • GO-2025-3941 CVE-2025-58450 GHSA-p46v-f2x8-qp98
  • GO-2025-3942 CVE-2025-58063 GHSA-93mf-426m-g6x9
  • GO-2025-3943 CVE-2025-58430 GHSA-rf24-wg77-gq7w
  • GO-2025-3944 CVE-2025-54123 GHSA-r4h8-hfp2-ggmf
  • GO-2025-3945 CVE-2025-54376 GHSA-jxmr-2h4q-rhxp
  • GO-2025-3949 CVE-2025-59361 GHSA-2gcv-3qpf-c5qr
  • GO-2025-3950 CVE-2025-9076 GHSA-3vcm-c42p-3hhf
  • GO-2025-3951 CVE-2025-59358 GHSA-2gg8-85m5-8r2p
  • GO-2025-3952 CVE-2025-59359 GHSA-369h-6j28-wwcg
  • GO-2025-3953 CVE-2025-8396 GHSA-p768-c3pr-6459
  • GO-2025-3954 CVE-2025-59360 GHSA-xv9f-728h-9jgv
  • GO-2025-3958 CVE-2025-9072 GHSA-69j8-prx2-vx98
  • GO-2025-3959 CVE-2025-9078 GHSA-9p92-x77w-9fw2
  • GO-2025-3960 CVE-2025-9084 GHSA-hm95-jx66-g2gh
  • GO-2025-3961 CVE-2025-4953 GHSA-m68q-4hqr-mc6f

• Update to version 0.0.20250908T141310 2025-09-08T14:13:10Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3916 CVE-2025-51667 GHSA-f2m2-4q6r-cwc4
  • GO-2025-3917 CVE-2025-53884 GHSA-8ff6-pc43-jwv3
  • GO-2025-3918 CVE-2025-8077 GHSA-8pxw-9c75-6w56
  • GO-2025-3919 CVE-2025-54467 GHSA-w54x-xfxg-4gxq
  • GO-2025-3920 GHSA-vxg3-w9rv-rhr2
  • GO-2025-3921 GHSA-3rw9-wmc8-8948
  • GO-2025-3923 CVE-2024-58259 GHSA-4h45-jpvh-6p5j
  • GO-2025-3924 CVE-2025-6203 GHSA-8f82-53h8-2p34
  • GO-2025-3925 GHSA-v2ch-c8v8-fgr7
  • GO-2025-3927 CVE-2024-52284 GHSA-6h9x-9j5v-7w9h
  • GO-2025-3930 CVE-2025-58355 GHSA-33pr-m977-5w97
  • GO-2025-3934 CVE-2025-55190 GHSA-786q-9hcg-v9ff
  • GO-2025-3935 CVE-2025-9566 GHSA-wp3j-xq48-xpjw
  • GO-2025-3936 CVE-2025-56760 GHSA-78j5-8vq7-jxv5
  • GO-2025-3937 CVE-2025-56761 GHSA-cgrg-86m5-xm4w

This update for warewulf4 fixes the following issues:

Update to version 4.6.4.

Security issues fixed:

• CVE-2025-58058: xz: excessive memory consuption when unpacking a large number of corrupted LZMA archives (bsc#1248906).

Other issues fixed:

• Convert disk booleans from wwbool to *bool which allows bools in disk to be set to false via command line (bsc#1248768).

• Fix wwctl upgrade nodes to handle kernel argument lists (bsc#1227686, bsc#1227465).

• Mark slurm as recommeneded in the warewulf4-overlay-slurm package (bsc#1246082).

• Switch to dnsmasq as default DHCP and TFTP provider.

• v4.6.4 release updates:

  • Update NetworkManager Overlay
    • Disable IPv4 in NetworkManager if no address or route is specified
  • Fix(wwctl): create overlay edit tempfile in tmpdir
  • Add default for systemd name for warewulf in warewulf.conf
  • Atomic overlay file application in wwclient
  • Simpler names for overlay methods
  • Fix warewulfd API behavior when deleting distribution overlay

• v4.6.3 release updates:

  • IPv6 iPXE support
  • Fix a race condition in wwctl overlay edit
  • Fixed handling of comma-separated mount options in fstab and ignition overlays
  • Move reexec.Init() to beginning of wwctl
  • Added warewuld configure option
  • Address copilot review from #1945
  • Bugfix: cloning a site overlay when parent dir does not exist
  • Clone to a site overlay when adding files in wwapi
  • Consolidated createOverlayFile and updateOverlayFile to addOverlayFile
  • Support for creating and updating overlay file in wwapi
  • Only return overlay files that refer to a path within the overlay
  • Add overlay file deletion support
  • DELETE /api/overlays/{id}?force=true can delete overlays in use
  • Restore idempotency of PUT /api/nodes/{id}
  • Simplify overlay mtime API and add tests
  • Add node overlay buildtime
  • Improved netplan support
  • Rebuild overlays for discovered nodes

• v4.6.2 release updates:

  • (preview) support for provisioning to local disk

• incoperated from v4.6.1:

  • REST API, which is disabled in the default configuration

This update for alloy fixes the following issues:

• CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).
• CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).

This update for alloy fixes the following issues:

• update to 1.11.3:
• CVE-2025-58058: Fixed memory leaks in xz. (bsc#1248960)
• CVE-2025-11065: Fixed sensitive Information leak in logs. (bsc#1250621)

This update for rekor fixes the following issues:

Security fixes:

• CVE-2025-58058: Fixed github.com/ulikunitz/xz leaks memory (bsc#1248910)
• CVE-2025-29923: Fixed potential out of order responses when CLIENT SETINFO times out during connection establishment (bsc#1241153)

Other fixes:

• Update to version 1.4.3
• Update to version 1.4.2
• Update to version 1.4.1 (jsc#SLE-23476)

This update for containerized-data-importer fixes the following issues:

• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2026-25680: golang.org/x/net/html: denial of service when parsing arbitrary HTML (bsc#1267176).
• CVE-2026-25681: golang.org/x/net/html: incorrect handling of character references in DOCTYPE nodes (bsc#1267176).
• CVE-2026-27136: golang.org/x/net/html: duplicate attributes can cause XSS (bsc#1267176).
• CVE-2026-42502: golang.org/x/net/html: incorrect handling of HTML elements in foreign content (bsc#1267176).
• CVE-2026-42506: golang.org/x/net/html: incorrect handling of namespaced elements in foreign content (bsc#1267176).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827: golang.org/x/crypto/ssh: newChannel leak after Reject() (bsc#1266179).
• CVE-2026-39828: golang.org/x/crypto/ssh: bypass of certificate restrictions (bsc#1266179).
• CVE-2026-39829: golang.org/x/crypto/ssh: pathological RSA/DSA parameters may cause DoS (bsc#1266179).
• CVE-2026-39830: golang.org/x/crypto/ssh: client can cause server deadlock on unexpected responses (bsc#1266179).
• CVE-2026-39831: golang.org/x/crypto/ssh: bypass of FIDO/U2F security keys physical interaction (bsc#1266179).
• CVE-2026-39832: golang.org/x/crypto/ssh: remote agent constraint extensions dropped (bsc#1266179).
• CVE-2026-39833: golang.org/x/crypto/ssh: lifetime without confirm constraint (bsc#1266179).
• CVE-2026-39834: golang.org/x/crypto/ssh: infinite loop on large channel writes (bsc#1266179).
• CVE-2026-39835: golang.org/x/crypto/ssh: server panic during CheckHostKey/Authenticate (bsc#1266179).
• CVE-2026-42508: golang.org/x/crypto/ssh: failure to enforce @revoked status (bsc#1266179).
• CVE-2026-46595: golang.org/x/crypto/ssh: VerifiedPublicKeyCallback permissions skip enforcement (bsc#1266179).
• CVE-2026-46597: golang.org/x/crypto/ssh: byte arithmetic causes underflow and panic (bsc#1266179).
• CVE-2026-46598: golang.org/x/crypto/ssh: pathological inputs can lead to client panic (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1278621).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278621).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278621).