CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

A vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

A vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line,…

Root has patched CVE-2025-58181 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

This update bring new features, bugs and vulnerabilities fixed in rclone and golang components used to build it.

This update for trivy fixes the following issues:

• Update to version 0.68.2:
  • release: v0.68.2 [release/v0.68] (#9950)
  • fix(deps): bump alpine from 3.22.1 to 3.23.0 [backport: release/v0.68] (#9949)
  • ci: enable check-latest for setup-go [backport: release/v0.68] (#9946)

These are all security issues fixed in the rclone-1.72.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cloudflared-2025.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cheat-4.4.2-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the netbird-0.60.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the zk-0.15.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for git-bug fixes the following issues:

Changes in git-bug:

• Revendor to include fixed version of depending libraries:

  • GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade golang.org/x/crypto to v0.43.0
  • GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade github.com/go-viper/mapstructure/v2 to v2.4.0
  • GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous
  • GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade github.com/cloudflare/circl to v1.6.1
  • GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade golang.org/x/crypto/ssh to v0.45.0
  • GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade golang.org/x/crypto/ssh/agent to v0.45.0

• Revendor to include golang.org/x/net/html v 0.45.0 to prevent possible DoS by various algorithms with quadratic complexity when parsing HTML documents (bsc#1251463, CVE-2025-47911 and bsc#1251664, CVE-2025-58190).

Update to version 0.10.1:

• cli: ignore missing sections when removing configuration (ddb22a2f)

Update to version 0.10.0:

• bridge: correct command used to create a new bridge (9942337b)
• web: simplify header navigation (7e95b169)
• webui: remark upgrade + gfm + syntax highlighting (6ee47b96)
• BREAKING CHANGE: dev-infra: remove gokart (89b880bd)

Update to version 0.10.0:

• bridge: correct command used to create a new bridge (9942337b)
• web: simplify header navigation (7e95b169)
• web: remark upgrade + gfm + syntax highlighting (6ee47b96)

Update to version 0.9.0:

• completion: remove errata from string literal (aa102c91)
• tui: improve readability of the help bar (23be684a)

Update to version 0.8.1+git.1746484874.96c7a111:

• docs: update install, contrib, and usage documentation (#1222)
• fix: resolve the remote URI using url.*.insteadOf (#1394)
• build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)
• chore: gofmt simplify gitlab/export_test.go (#1392)
• fix: checkout repo before setting up go environment (#1390)
• feat: bump to go v1.24.2 (#1389)
• chore: update golang.org/x/net (#1379)
• fix: use -0700 when formatting time (#1388)
• fix: use correct url for gitlab PATs (#1384)
• refactor: remove depdendency on pnpm for auto-label action (#1383)
• feat: add action: auto-label (#1380)
• feat: remove lifecycle/frozen (#1377)
• build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)
• feat: support new exclusion label: lifecycle/pinned (#1375)
• fix: refactor how gitlab title changes are detected (#1370)
• revert: "Create Dependabot config file" (#1374)
• refactor: rename //:git-bug.go to //:main.go (#1373)
• build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)
• fix: set GitLastTag to an empty string when git-describe errors (#1355)
• chore: update go-git to v5@masterupdate_mods (#1284)
• refactor: Directly swap two variables to optimize code (#1272)
• Update README.md Matrix link to new room (#1275)

• Update to version 0.8.0+git.1742269202.0ab94c9:

  • deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)

• Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494, CVE-2025-22869).

• Add missing Requires to completion subpackages.

Update to version 0.8.0+git.1733745604.d499b6e:

• fix typos in docs (#1266)
• build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)

• bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).

This update for cheat fixes the following issues:

• Security:

  • CVE-2025-47913: Fix client process termination (bsc#1253593)
  • CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)
  • CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)
  • Replace golang.org/x/crypto=golang.org/x/[email protected]
  • Replace golang.org/x/net=golang.org/x/[email protected]
  • Replace golang.org/x/sys=golang.org/x/[email protected]

• Packaging improvements:

  • Drop Requires: golang-packaging. The recommended Go toolchain dependency expression is BuildRequires: golang(API) >= 1.x or optionally the metapackage BuildRequires: go
  • Use BuildRequires: golang(API) >= 1.19 matching go.mod
  • Build PIE with pattern that may become recommended procedure: %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build A go toolchain buildmode default config would be preferable but none exist at this time.
  • Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
  • Remove go build -o output binary location and name. Default binary has the same name as package of func main() and is placed in the top level of the build directory.
  • Add basic %check to execute binary --help

• Packaging improvements:

  • Service go_modules replace dependencies with CVEs
  • Replace github.com/cloudflare/circl=github.com/cloudflare/[email protected] Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm
  • Replace golang.org/x/net=golang.org/x/[email protected] Fixes GO-2025-3503 CVE-2025-22870
  • Replace golang.org/x/crypto=golang.org/x/[email protected] Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8 Fixes GO-2025-3487 CVE-2025-22869
  • Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/[email protected] Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4 Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
  • Service tar_scm set mode manual from disabled
  • Service tar_scm create archive from git so we can exclude vendor directory upstream committed to git. Committed vendor directory contents have build issues even after go mod tidy.
  • Service tar_scm exclude dir vendor
  • Service set_version set mode manual from disabled
  • Service set_version remove param basename not needed

These are all security issues fixed in the apptainer-1.4.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mcphost-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rekor-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the traefik-3.6.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the traefik2-2.11.35-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the vexctl-0.4.1+git78.f951e3a-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cosign-3.0.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-stable-24.0.9_ce-17.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubo-0.40.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rz-pm-0.3.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the k3sup-0.13.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubeseal-0.41.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kumactl-3.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for elemental-register, elemental-toolkit fixes the following issues:

elemental-register was updated to 1.8.1:

Changes on top of v1.8.1:

• Update headers to 2026
• Update questions to include SL Micro 6.2

Update to v1.8.1:

• Install yip config files in before-install step
• Bump github.com/rancher-sandbox/go-tpm and its dependencies This includes few CVE fixes:
  • bsc#1241826 (CVE-2025-22872)
  • bsc#1241857 (CVE-2025-22872)
  • bsc#1251511 (CVE-2025-47911)
  • bsc#1251679 (CVE-2025-58190)

elemental-toolkit was updated to v2.3.2:

• Bump golang.org/x/crypto library This includes few CVE fixes:
  • bsc#1241826 (CVE-2025-22872)
  • bsc#1241857 (CVE-2025-22872)
  • bsc#1251511 (CVE-2025-47911)
  • bsc#1251679 (CVE-2025-58190)
  • bsc#1253581 (CVE-2025-47913)
  • bsc#1253901 (CVE-2025-58181)
  • bsc#1254079 (CVE-2025-47914)

This update for docker fixes the following issues:

• CVE-2025-58181: not validating the number of mechanisms can cause unlimited memory consumption (bsc#1253904).

This update for docker-stable fixes the following issues:

• CVE-2025-58181: Fixed unbounded memory consumption. (bsc#1253904)
• CVE-2025-30204: Fixed a bug in jwt-go which allows excessive memory allocation during header parsing. (bsc#1240513)

This update for cosign fixes the following issues:

Update to version 3.0.5:

• CVE-2026-24122: Fixed improper validation of certificates that outlive expired CA certificates (bsc#1258542)
• CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612)
• CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139)
• CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562)
• CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080)
• CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085)
• CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620)
• CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry under certain conditions (bsc#1256496)
• CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913)

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.73.5:

  • Version v1.73.5
  • operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
  • rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
  • rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
  • s3: fix empty delimiter parameter rejected by Archiware P5 server
  • azureblob/auth: add Microsoft Partner Network User-Agent prefix
  • drime: fix User.EntryPermissions JSON unmarshalling
  • filter: fix debug logs that fire before logger is configured - fixes #9291
  • s3: fix TencentCOS CDN endpoint failing on bucket check
  • iclouddrive: fix 'directory not found' error when the directory contains accent marks
  • Start v1.73.5-DEV development

• Update to version 1.73.4:

  • Version v1.73.4
  • Update to go 1.25.9 to fix multiple CVEs
  • build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
  • docs: fix markdown issues in mount docs
  • docs: fix header level for metadata option
  • fix(docs): Fix link to not be language specific
  • filen: update SDK version
  • build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0
  • docs: note macOS 10.15 (Catalina) support with version v1.70.3
  • Start v1.73.4-DEV development

• Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)

  • Version v1.73.3
  • build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2
  • docs/jottacloud: fix broken link
  • docs: clarify Filen password change requires updating both password and API key in rclone config
  • docs: note that Filen API key changes on password change
  • build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
  • s3: add multi tenant support for Cubbit
  • lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching
  • list: fix nil pointer panic in Sorter when temp file creation fails
  • docs: update RELEASE procedure to avoid mistakes
  • docs: added text to the label showing version-introduced info
  • Start v1.73.3-DEV development
  • docs: update sponsors

• Update to version 1.73.2:

  • Version v1.73.2
  • Update to go 1.25.8 to fix multiple CVEs
  • build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220
  • docs: fix new drive flag typo in changelog
  • webdav: add missing headers for CORS
  • docs: Document unsupported S3 object keys with double slashes
  • docs: note that --use-server-modtime only works on some backends
  • internxt: fix Entry doesn't belong in directory errors on windows
  • drime: fix chunk-uploaded files ignoring workspace ID
  • docs: Fix headers hierarchy for mount.md
  • webdav: escape reserved characters in URL path segments
  • bisync: add group Sync to the bisync command
  • archive: extract: strip "./" prefix from tar entry paths
  • docs: add instructions on how to update Go version
  • buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
  • Start v1.73.2-DEV development

• Update to version 1.73.1:

  • Version v1.73.1
  • build: fix build using go 1.26.0 instead of go 1.25.7
  • fs/march: fix runtime: program exceeds 10000-thread limit
  • accounting: fix missing server side stats from core/stats rc
  • pacer: re-read the sleep time as it may be stale
  • pacer: fix deadlock between pacer token and --max-connections
  • build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167
  • drime: fix files and directories being created in the default workspace
  • docs: update sponsors
  • copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.
  • internxt: implement re-login under refresh logic, improve retry logic - fixes #9174
  • docs: add ExchangeRate-API as a sponsor
  • build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316
  • Set list_version to 2 for FileLu S3 configuration
  • filelu: add multipart upload support…

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix CVE-2026-34986 (bsc#1262956) * github.com/go-jose/go-jose/[email protected] CVE-2026-33186 GO-2026-4762 (bsc#1260311) * google.golang.org/[email protected] CVE-2026-24137 GO-2026-4358 (bsc#1264177) * github.com/sigstore/[email protected] Fix fallout: github.com/moby/[email protected] github.com/containers/image/v5=github.com/containers/image/[email protected]

• Fix HTML parser misimplementation of a part of the HTML specification for table related tags (CVE-2025-58190, GO-2026-4441, bsc#1258048).

• Fix issue where the HTML parser takes a very long time or even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).

• Update ot 1.4.5

  • Fix for moderate severity GO-2025-4176 / CVE-2025-65105 / GHSA-j3rw-fx6g-q46j (bsc#1255462): Ineffective application of selinux / apparmor --security option. Updates of a few dependent go libraries for related security fixes.
  • Other fix Run FUSE processes in a separate process group. This detaches them from the main process so they don't receive signals such as interrupts sent to a terminal there. This was not a problem with interactive shells because they start their own group, but was a problem with some programs with interactive Read/Eval/Print/Loops such as python. An interrupt there would kill the FUSE processes.

• From 1.4.4

  • By applying patches to the bundled fuse2fs, allow again the possibility of using a non-writable ext3 image file as an overlay. Fixes regression introduced in 1.4.3.
  • If an overlay or bound data image is asked to be mounted writable but the user has no write access to the image, show a warning message instead of silently switching to readonly.
  • Avoid a fatal error when starting fakeroot from suid mode while in an NFS directory.
  • Fix 32-bit builds which were accidentally broken by a library upgrade that was done for a minor security issue.

• Fix CVEs:

  • GO-2025-4135 - CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent.
  • GO-2025-4134 - CVE-2025-58181 - bsc#1253924 Unbounded memory consumption in golang.org/x/crypto/ssh.
  • GO-2025-4116 - CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent.
  • GO-2025-3595 - CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net.
  • GO-2025-3503 - CVE-2025-22870 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.
  • GO-2025-3487 - CVE-2025-22869 Potential denial of service in golang.org/x/crypto.
  • GO-2025-3485 - CVE-2025-27144 DoS in go-jose Parsing in github.com/go-jose/go-jose.
  • GO-2025-3754 - CVE-2025-8556 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl.

• No need for binutils-gold for aarch64

• Update to 1.4.3

  • Corrected the mconfig -s option for statically building apptainer and starter binaries.
  • Resolved an issue where the Makefile generated by mconfig -b failed when the build directory was not a subdirectory of the Apptainer source code.
  • Fixed %files in definition files to correctly copy symlinks pointing above the destination directory but within the destination stage root filesystem.
  • Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was corrected to libnvoptix.so).
  • Prevented timeouts during cleanup after building gocryptfs-encrypted SIF files.
  • Fixed a bug that prevented build with --passphrase or --pem-path (without --encrypt) from implying fakeroot.
  • Resolved a hang when copying files between build stages while using suid mode without user namespaces.
  • Fixed issues with running and building containers of different architectures than the host via binfmt_misc when using rootless fakeroot.
  • Corrected "target: no such file or directory" errors when …

This update for mcphost fixes the following issues

• CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1265274).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1265275).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253952).
• CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260224).

Changes for mcphost:

• Updated to version 0.34.0

• Features:

• Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)
• Add Google Vertex AI support for Claude models
• Add new models.

• Fixes:

• Eliminate escape sequence leak from spinner tea.Program instances.
• Fix anthropic api issue.
• Convert JSON Schema draft-07 exclusive bounds to draft-04 format.

• Upgrade all dependencies to latest versions, resolve security issues and to obtain Go 1.26 compatibility.

This update for trivy fixes the following issues:

Update to version 0.68.2:

Security fixes:

• CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).
• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).
• CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).
• CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).
• CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).
• CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).
• CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).
• CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).
• CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251547).

Other fixes:

• Update installation.md (#8979)
• chore(alpine): add EOL date for Alpine 3.21 (#8221)
• chore(alpine): add EOL date for Alpine 3.22 (#8992)
• chore(cli): Remove Trivy Cloud (#9847)
• chore(deps): Bump trivy-checks (#7819)
• chore(deps): Bump trivy-checks (#8310)
• chore(deps): Bump trivy-checks (#8619)
• chore(deps): Bump trivy-checks (#8934)
• chore(deps): Bump trivy-checks to v1.7.1 (#8467)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• chore(deps): Switch to go-viper/mapstructure (#9579)
• chore(deps): Update trivy-checks (#8798)
• chore(deps): Upgrade trivy-checks (#8018)
• chore(deps): bump Go to v1.23.5 (#8341)
• chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 (#8105)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 (#8140)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
• chore(deps): bump alpine from…

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.5.2

  • Add more information to proxy-dns removal message
  • Update tail command to use /management/logs endpoint
  • Add cloudflared management token command
  • Fix bugs
  • Update golang.org/x/net to 0.55.0 (boo#1266794, boo#1265920, CVE-2026-39821 CVE-2026-33814)

• Update version to 2026.2.0

  • Fix bugs

• Update version to 2025.11.1

  • bump coredns to solve CVE
  • add vulncheck to cloudflared
  • Remove references to cloudflare-go
  • Add logging format as JSON
  • Centralize UDP origin proxy dialing as ingress service
  • Add virtual DNS service
  • Add OriginDialerService to include TCP
  • Add --dns-resolver-addrs flag
  • Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences
  • Bump go-boring from 1.24.2 to 1.24.4
  • Add metrics for virtual DNS origin
  • set proper url and hostname for cloudflared tail command
  • Add support for login interstitial auto closure
  • update fed callback url for login helper
  • Correct QUIC connection management for datagram handlers
  • Set endpoint in tunnel credentials when generating locally managed tunnel with a Fed token
  • Migrate cloudflared-ci pipelines to Gitlab CI
  • Add support for FedRAMP in originRequest Access config
  • Add buffers for UDP and ICMP datagrams in datagram v3
  • Add write deadline for UDP origin writes
  • Improve metrics for datagram v3
  • Force usage of go-boring 1.24
  • Fix import of GPG keys when two keys are provided
  • Fix parameter order when uploading RPM .repo file to R2
  • Add new datagram v3 feature flag
  • Bump datagram v3 write channel capacity
  • Fix upload of RPM repo file during double signing
  • Fix the cloudflared binary path used in the component test
  • Fix typo causing r2-release-next deployment to fail
  • Update from go1.24.6 to go1.24.9
  • Fix systemd service installation hanging
  • Add cf-proxy-* to control response headers
  • Add pipelines for linux packaging
  • Prefix gitlab steps with operating system
  • Fix docker hub push step
  • Fix CVE-2025-58181 boo#1253918
  • Fix CVE-2025-22869 boo#1239422

• Update version to 2025.6.0

  • Remove dynamic reloading of features for datagram v3
  • Add metric for unsupported RPC commands for datagram v3
  • Add dynamic loading of features to connections via ConnectionOptionsSnapshot
  • Use is_default_network instead of is_default to create vnet's
  • Update go to 1.24

• Update version to 2025.4.2

  • emit explicit errors for the service command on unsupported OSes
  • Fix some issues

• Update version to 2024.12.1

  • TUN-8748: Migrated datagram V3 flows to use migrated context
  • TUN-8737: update metrics server port selection
  • TUN-8731: Implement diag/system endpoint
  • TUN-8728: implement diag/tunnel endpoint
  • TUN-8730: implement diag/configuration
  • TUN-8735: add managed/local log collection
  • TUN-8733: add log collection for docker
  • TUN-8734: add log collection for kubernetes
  • TUN-8640: Refactor ICMPRouter to support new ICMPResponders
  • TUN-8729: implement network collection for diagnostic procedure
  • TUN-8727: implement metrics, runtime, system, and tunnelstate in diagnostic http client
  • TUN-8726: implement compression routine to be used in diagnostic procedure
  • TUN-8732: implement port selection algorithm
  • TUN-8762: fix argument order when invoking tracert and modify network info output parsing
  • TUN-8769: fix k8s log collector arguments
  • TUN-8727: extend client to include function to get cli configuration and tunnel configuration
  • TUN-8725: implement diagnostic procedure
  • TUN-8767: include raw output from network collector in diagnostic zip file
  • TUN-8770: add cli configuration and tunnel configuration to diagnostic zipfile
  • TUN-8768: add job report to diagnostic zipfile
  • TUN-8775: Make sure the session Close can only be called once
  • TUN-8781: Add Trixie, drop…

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• golang.org/x/crypto/ssh: Fixed multiple issues: CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)

• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (boo#1266596).

• Update to version 6.6.2

  • Improve git default branch handling

• CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)

• Switch to go1.25 as required by update go image library.

• Update to version 6.6.0

  • Various bug fixes and performance improvements

• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258591).

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254023).

• CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253864).

• CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).

• Update to version 6.5.1

  • Fix team deletion not working
  • Chat attachments improvements
  • Miscellaneous bugfixes