CVE-2026-1229

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3.

Root has patched CVE-2026-1229 in the github.com/cloudflare/circl package for Root:Go. Multiple fixed versions available.

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .

CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl

This update bring new features, bugs and vulnerabilities fixed in rclone and golang components used to build it.

These are all security issues fixed in the rclone-1.73.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ssm-agent-3.3.4121.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kyverno-1.17.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cheat-5.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the enc-1.1.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go-sendxmpp-0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-12.4.5-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gopass-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.73.5:

  • Version v1.73.5
  • operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
  • rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
  • rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
  • s3: fix empty delimiter parameter rejected by Archiware P5 server
  • azureblob/auth: add Microsoft Partner Network User-Agent prefix
  • drime: fix User.EntryPermissions JSON unmarshalling
  • filter: fix debug logs that fire before logger is configured - fixes #9291
  • s3: fix TencentCOS CDN endpoint failing on bucket check
  • iclouddrive: fix 'directory not found' error when the directory contains accent marks
  • Start v1.73.5-DEV development

• Update to version 1.73.4:

  • Version v1.73.4
  • Update to go 1.25.9 to fix multiple CVEs
  • build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
  • docs: fix markdown issues in mount docs
  • docs: fix header level for metadata option
  • fix(docs): Fix link to not be language specific
  • filen: update SDK version
  • build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0
  • docs: note macOS 10.15 (Catalina) support with version v1.70.3
  • Start v1.73.4-DEV development

• Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)

  • Version v1.73.3
  • build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2
  • docs/jottacloud: fix broken link
  • docs: clarify Filen password change requires updating both password and API key in rclone config
  • docs: note that Filen API key changes on password change
  • build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
  • s3: add multi tenant support for Cubbit
  • lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching
  • list: fix nil pointer panic in Sorter when temp file creation fails
  • docs: update RELEASE procedure to avoid mistakes
  • docs: added text to the label showing version-introduced info
  • Start v1.73.3-DEV development
  • docs: update sponsors

• Update to version 1.73.2:

  • Version v1.73.2
  • Update to go 1.25.8 to fix multiple CVEs
  • build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220
  • docs: fix new drive flag typo in changelog
  • webdav: add missing headers for CORS
  • docs: Document unsupported S3 object keys with double slashes
  • docs: note that --use-server-modtime only works on some backends
  • internxt: fix Entry doesn't belong in directory errors on windows
  • drime: fix chunk-uploaded files ignoring workspace ID
  • docs: Fix headers hierarchy for mount.md
  • webdav: escape reserved characters in URL path segments
  • bisync: add group Sync to the bisync command
  • archive: extract: strip "./" prefix from tar entry paths
  • docs: add instructions on how to update Go version
  • buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
  • Start v1.73.2-DEV development

• Update to version 1.73.1:

  • Version v1.73.1
  • build: fix build using go 1.26.0 instead of go 1.25.7
  • fs/march: fix runtime: program exceeds 10000-thread limit
  • accounting: fix missing server side stats from core/stats rc
  • pacer: re-read the sleep time as it may be stale
  • pacer: fix deadlock between pacer token and --max-connections
  • build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167
  • drime: fix files and directories being created in the default workspace
  • docs: update sponsors
  • copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.
  • internxt: implement re-login under refresh logic, improve retry logic - fixes #9174
  • docs: add ExchangeRate-API as a sponsor
  • build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316
  • Set list_version to 2 for FileLu S3 configuration
  • filelu: add multipart upload support…

This update for git-bug fixes the following issues:

Changes in git-bug:

• CVE-2026-1229: CIRCL had an incorrect calculation in secp384r1 CombinedMult (bsc#1265416, GO-2026-4550): updated github.com/cloudflare/circl to v1.6.3
• CVE-2026-41506: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264955, GO-2026-4910): updated github.com/go-git/go-git/v5 to v5.17.1

This update for enc fixes the following issues:

Changes in enc:

• CVE-2026-1229: Fix incorrect value (bsc#1265533) Bump circl to 1.6.3

• Update to 1.1.5:

  • Update dependencies #10

• Update to 1.1.4:

  • Update all dependencies #9

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for go-sendxmpp fixes the following issues:

Changes in go-sendxmpp:

• Update to 0.16.0: Added:

  • Add Ox support to http-upload.
  • Add Ox support for private group chats.
  • Show error cause if joining MUCs failedi (requires go-xmpp >= v0.3.5). Changed:
  • Fix --ox-delete-nodes.
  • Fix receiving of 1-1 messages while joined in a MUC.
  • Use go-sendxmpp + a random ID as fallback MUC alias.
  • Strip leading "xmpp:" from recipients.
  • Strip trailing "?join" from MUC JIDs.
  • Add context for timeouts in stanza handling.
  • Check ID for disco items reply (requires go-xmpp >= v0.3.6).
  • Reduce channel buffer size to 1 where only one item will be returned.
  • Deprecate legacy PGP.
  • CVE-2026-1229: The CombinedMult function produces an incorrect value (bsc#1265538) Bump circl to 1.6.3
  • CVE-2026-39821: Failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266617) Bump net to 0.56.0

• Update to 0.15.8:

  • Fix windows build (windows doesn't support syscalls Setgid and Setuid).

• Update to 0.15.7:

  • Fix http-upload with legacy PGP encryption.
  • Fix reading of environment variables.
  • Fix a bug in looking up host meta 2.
  • Try to drop root privileges before connecting to the server.
  • Fix crash if a config key has no value.
  • Use a salt for stored FAST token.
  • Increase scrypt iterations for storing FAST token from 32768 to 65536.
  • Log a warning when --no-tls-verify or -n is set.

• Update to 0.15.6: Added:

  • New config option allow_plain. Changed:
  • Explain each configuration option in manpage go-sendxmpp(5).
  • Improve config parsing robustness.
  • Update link in manpage as Gitlab calls issues now work items.
  • Recognize stanza size limit updates after authentication (via go-xmpp >= v0.3.3).
  • Tell connection target in error message when failing to connect.

• Drop tar-scm service and use regular tarball and go_modules

• Update to 0.15.5:

  • Fix SASL SCRAM Downgrade Protection in case of server providing different mechanisms for SASL and SASL2 (requires go-xmpp >0 v0.3.2).

• Update to 0.15.4:

  • http-upload: Manually set content length for HTTP request (fixes issues with certain http modules/proxies).

• Update to 0.15.3:

  • Fix PLAIN authentication for SASL2 (requires go-xmpp >= v0.3.1).

• Update to 0.15.2:

  • Use UUIDv7 instead of UUIDv4 for stanza IDs (requires go-xmpp >= v0.2.19).
  • Fix stanza syntax error for legacy PGP messages.
  • Print error if legacy PGP and Ox are requested simultaneously.
  • Reworked OOB file sending and http-upload to use new functions from go-xmpp library (requires go-xmpp >= v0.3.0).
  • Try password login if FAST login fails.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for grafana fixes the following issues:

Changes in grafana:

Update to version 12.4.10:

• Security:

  • CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426)
  • CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973)
  • CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307)
  • CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)

• Bug fixes:

  • Dashboards: Fix adhoc and groupby variable datasource on UI import
  • Dashboards: Fix version dates and user display names in the legacy version history page

Update to version 12.4.9:

• Features and enhancements:

  • Dashboard Import: Labels in v2 schema

• Bug fixes:

  • Azure Monitor: fix migration for dimension filters

Update to version 12.4.8:

• Security:

  • CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

Update to version 12.4.7:

• Security:

  • CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)

• Features and enhancements:

  • Dashboards: Get annotations and dashboard endpoint performance improvements

• Bug fixes:

  • DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

Update to version 12.4.6:

• Security:

  • CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)

• Features and enhancements:

  • Alerting: Add protected fields authorization check to provisioning API
  • Alerting: Return 403 instead of 500 on contact point provenance mismatch

• Bug fixes:

  • Jaeger: Handle gzip, deflate, and brotli compressed API responses
  • Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217)

• CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868)

• CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328)

• CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763)

• CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

• CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)

• CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260317T205859 2026-03-17T20:58:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
  • GO-2026-4360 CVE-2026-0528 GHSA-w2gr-585j-r428
  • GO-2026-4513
  • GO-2026-4514
  • GO-2026-4518
  • GO-2026-4526
  • GO-2026-4549 CVE-2026-24005 GHSA-9fj4-3849-rv9g
  • GO-2026-4550 CVE-2026-1229 GHSA-q9hv-hpm4-hj6x
  • GO-2026-4551 CVE-2026-27575 GHSA-3ccg-x393-96v8
  • GO-2026-4552 CVE-2026-27116 GHSA-4qgr-4h56-8895
  • GO-2026-4553 CVE-2026-27616 GHSA-7jp5-298q-jg98
  • GO-2026-4554 CVE-2026-27730 GHSA-p2v6-84h2-5x4r
  • GO-2026-4556 CVE-2026-27819 GHSA-42wg-38gx-85rh
  • GO-2026-4557 CVE-2026-26186 GHSA-49xw-vfc4-7p43
  • GO-2026-4558 CVE-2026-27808 GHSA-mpf7-p9x7-96r3
  • GO-2026-4560 CVE-2026-27465 GHSA-2v6m-6xw3-6467
  • GO-2026-4561 CVE-2026-25963 GHSA-5jvp-m9h4-253h
  • GO-2026-4562 CVE-2026-27900 GHSA-5rc7-2jj6-mp64
  • GO-2026-4563 CVE-2026-24004 GHSA-9pm7-6g36-6j78
  • GO-2026-4564 CVE-2026-23999 GHSA-ppwx-5jq7-px2w
  • GO-2026-4565 CVE-2026-22728 GHSA-465p-v42x-3fmj
  • GO-2026-4566 CVE-2026-27899 GHSA-5rmx-256w-8mj9
  • GO-2026-4567 CVE-2026-27965 GHSA-8g8j-r87h-p36x
  • GO-2026-4568 GHSA-gj6x-q8rh-wj6x
  • GO-2026-4569 CVE-2026-27896 GHSA-wvj2-96wp-fq3f
  • GO-2026-4570 CVE-2026-27969 GHSA-r492-hjgh-c9gw
  • GO-2026-4571 CVE-2026-27734 GHSA-phwh-4f42-gwf3
  • GO-2026-4572 CVE-2026-27946 GHSA-282g-fhmx-xf54
  • GO-2026-4573 CVE-2026-27840 GHSA-6mq3-xmgp-pjm5
  • GO-2026-4574 CVE-2026-27945 GHSA-7777-fhq9-592v
  • GO-2026-4575 CVE-2026-28268 GHSA-rfjg-6m84-crj2
  • GO-2026-4576 CVE-2026-28280 GHSA-4rv8-5cmm-2r22
  • GO-2026-4577 CVE-2026-28407 GHSA-945p-3jhm-6rcp
  • GO-2026-4578 CVE-2025-14443 GHSA-gxvv-45f6-3ch8
  • GO-2026-4579 CVE-2026-28279 GHSA-rchw-322g-f7rm
  • GO-2026-4580 CVE-2026-28406 GHSA-6rxq-q92g-4rmf
  • GO-2026-4581 GHSA-xfx2-prg5-jq3g
  • GO-2026-4583 GHSA-54p8-x2m9-c593
  • GO-2026-4584 CVE-2026-28342 GHSA-pc8g-78pf-4xrp
  • GO-2026-4585 CVE-2026-28492 GHSA-mr74-928f-rw69
  • GO-2026-4586 CVE-2026-28789 GHSA-45m3-398w-m2m9
  • GO-2026-4587 CVE-2026-28790 GHSA-4fqm-6fmh-82mq
  • GO-2026-4588 CVE-2026-29049 GHSA-7rp8-r62p-q6wc
  • GO-2026-4589 CVE-2021-25320 GHSA-gqf8-rvrh-g7w6
  • GO-2026-4590 GHSA-hwm2-4ph6-w6m5
  • GO-2026-4591 CVE-2025-62879 GHSA-wj3p-5h3x-c74q
  • GO-2026-4592 CVE-2026-29073 GHSA-jqwg-75qf-vmf9
  • GO-2026-4593 CVE-2026-26998 GHSA-fw45-f5q2-2p4x
  • GO-2026-4594 CVE-2026-26999 GHSA-xw98-5q62-jx94
  • GO-2026-4595 CVE-2026-3351 GHSA-crmg-9m86-636r
  • GO-2026-4596 CVE-2026-29183 GHSA-6865-qjcf-286f
  • GO-2026-4597 CVE-2026-29054 GHSA-92mv-8f8w-wq52
  • GO-2026-4598 CVE-2026-29042 GHSA-95fj-3w7g-4r27
  • GO-2026-4599 CVE-2026-27137
  • GO-2026-4600 CVE-2026-27138
  • GO-2026-4601 CVE-2026-25679
  • GO-2026-4602 CVE-2026-27139
  • GO-2026-4603 CVE-2026-27142
  • GO-2026-4604 CVE-2026-29193 GHSA-25rw-g6ff-fmg8
  • GO-2026-4605 CVE-2026-29192 GHSA-6rx5-m2rc-hmf7
  • GO-2026-4606 CVE-2026-29188 GHSA-79pf-vx4x-7jmm
  • GO-2026-4607 CVE-2026-29191 GHSA-pr34-2v5x-6qjq
  • GO-2026-4608 CVE-2026-29771 GHSA-rhr9-hgcm-x289
  • GO-2026-4609 CVE-2026-29781 GHSA-hx52-cv84-jr5v
  • GO-2026-4610 CVE-2025-15558 GHSA-p436-gjf2-799p
  • GO-2026-4612 CVE-2026-28683 GHSA-3c22-5j5m-4jq7
  • GO-2026-4613 CVE-2026-28682 GHSA-c36c-7pc2-f2ph
  • GO-2026-4614 CVE-2026-27944 GHSA-g9w5-qffc-6762
  • GO-2026-4615 CVE-2026-29060 GHSA-m2hx-wjxc-9fp4
  • GO-2026-4616 CVE-2026-25921 GHSA-cj4v-437j-jq4c
  • GO-2026-4617 CVE-2026-26194 GHSA-v9vm-r24h-6rqm
  • GO-2026-4618 CVE-2026-26195 GHSA-vgvf-m4fw-938j
  • GO-2026-4619 CVE-2026-26196 GHSA-x9p5-w45c-7ffc
  • GO-2026-4620 CVE-2026-26022 GHSA-xrcr-gmf5-2r8j
  • GO-2026-4621 GHSA-fwhj-785h-43hh
  • GO-2026-4622 CVE-2026-30223 GHSA-g962-2j28-3cg9
  • GO-2026-4623 CVE-2026-30224 GHSA-gq2m-77hf-vwgh
  • GO-2026-4624 CVE-2026-29084 GHSA-hcff-qv74-7hr4
  • GO-2026-4625 CVE-2026-30225 GHSA-p443-p7w5-2f7f
  • GO-2026-4626 CVE-2026-29061…

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for alloy fixes the following issues:

• CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
• CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
• CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

• Update to version 1.18.0:

• BREAKING: otelcol HTTP receivers default to idle_timeout='1m', read_header_timeout='1m', write_timeout='30s' to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
• Back off usage reporting on persistent failure
• Fix Beyla glob parsing
• Bump github.com/prometheus/procfs for XFS Collector fix
• database_observability.mysql: Simplify denylist in-memory map
• database_observability.postgres: Handle DSN with unix sockets
• database_observability.postgres: Update collect intervals
• database_observability: Explain-plan conditions now redact
• Don't emit error log when remotecfg is unused
• For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…

This update for grafana, system-user-grafana fixes the following issues:

• Update to version 12.4.10:

  • Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) CVE-2026-14199: Fix session takeover via Auth Proxy cache key collision (bsc#1278322)
  • Bug fixes: Dashboards: Fix adhoc and groupby variable datasource on UI import Dashboards: Fix version dates and user display names in the legacy version history page

• Update to version 12.4.9:

  • Features and enhancements: Dashboard Import: Labels in v2 schema
  • Bug fixes: Azure Monitor: fix migration for dimension filters

• Update to version 12.4.8:

  • Security: CVE-2026-19197: Fix access control in dashboard snapshots (bsc#1277025)

• Update to version 12.4.7:

  • Security: CVE-2026-56852: Fix infinite loop on truncated/invalid UTF-8 input in golang.org/x/text/unicode/norm (bsc#1272008)
  • Features and enhancements: Dashboards: Get annotations and dashboard endpoint performance improvements
  • Bug fixes: DashboardDS: Fix Mixed panels with a time override stuck in permanent loading

• Update to version 12.4.6:

  • Security: CVE-2026-41178: Fix opentelemetry-go's baggage parsing (bsc#1276658)
  • Features and enhancements: Alerting: Add protected fields authorization check to provisioning API Alerting: Return 403 instead of 500 on contact point provenance mismatch
  • Bug fixes: Jaeger: Handle gzip, deflate, and brotli compressed API responses Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL

• Drop 0005-Bump-edwards25519.patch

  CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters by updating to v1.43.0. (bsc#1274217) CVE-2026-8595: Fix stored XSS in the table panel (bsc#1271557) CVE-2026-42127: Fix DoS through memory exhaustion in grafana'a public dashboard query endpoint (bsc#1268868) CVE-2026-9029: Fix arbitrary code execution and information disclosure via XSS in geomap panel (bsc#1272328) CVE-2026-33814: Fix infinite loop in HTTP/2 transport by updating golang.org/x/net (bsc#1265763) CVE-2026-8609: Fix pre-authentication DoS in the OAuth login route (bsc#1271330)

  • CVE-2026-1229: Update github.com/cloudflare/circl to fix producing incorect output for specific inputs (bsc#1265525) (bsc#1262187)
  • CVE-2026-21723: Fix DoS vulnerability in Templates Test endpoint (bsc#1272427)

• CVE-2026-41606: Fix potential DoS in Apache Thrift (bsc#1263330)

• Build only for SUSE distributions