Every CVE Search/ Get API key

CVE-2026-25934

go-git improperly verifies data integrity values for .idx and .pack files

4.3 MediumFix available

CVE-2026-25934 is a medium vulnerability (CVSS 4.3) in Go-git, published February 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. Fixed in github.com/go-git/go-git/v5 5.16.5.

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.16%Up 0.2 points since Feb 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

go-git improperly verifies data integrity values for .idx and .pack files

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Record
CVE-2026-25934
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-354
Updated
2026-11-02
EUVDEUVD-2026-6247 4.3

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Record
EUVD-2026-6247
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-37cx-329c-33x3 4.3

go-git improperly verifies data integrity values for .idx and .pack files

Impact

A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found.

For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of https:// or known hosts for ssh://). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.

Patches

Users should upgrade to v5.16.5, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Workarounds

In case updating to a fixed version of go-git is not possible, users can run git fsck from the git cli to check for data corruption on a given repository.

Credit

Thanks @N0zoM1z0 for finding and reporting this issue privately to the go-git project.

Record
GHSA-37cx-329c-33x3
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-354
Updated
2026-11-02
NVD 4.3

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Record
CVE-2026-25934
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-354
Updated
2026-11-02
OSV 4.3

go-git improperly verifies data integrity values for .idx and .pack files

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Record
CVE-2026-25934
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-354
Updated
2026-11-02
OSVDEBIAN-CVE-2026-25934 4.3

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Record
DEBIAN-CVE-2026-25934
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 20 moreShow less
OSVGHSA-37cx-329c-33x3 4.3

go-git improperly verifies data integrity values for .idx and .pack files

Impact

A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found.

For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no impact on the trust relationship between the client and server, which is enforced based on the protocol being used (e.g. TLS in the case of https:// or known hosts for ssh://). In other words, the packfile checksum verification does not provide any security benefits when connecting to a malicious or compromised Git server.

Patches

Users should upgrade to v5.16.5, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Workarounds

In case updating to a fixed version of go-git is not possible, users can run git fsck from the git cli to check for data corruption on a given repository.

Credit

Thanks @N0zoM1z0 for finding and reporting this issue privately to the go-git project.

Record
GHSA-37cx-329c-33x3
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-354
Updated
2026-11-02
OSVUBUNTU-CVE-2026-25934 4.3

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Record
UBUNTU-CVE-2026-25934
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGO-2026-4473 No score

Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

Record
GO-2026-4473
Updated
2026-11-02
OSVopenSUSE-SU-2026:10618-1 No score

alloy-1.15.1-1.1 on GA media

These are all security issues fixed in the alloy-1.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10618-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10651-1 No score

trivy-0.70.0-1.1 on GA media

These are all security issues fixed in the trivy-0.70.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10651-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11694-1 No score

amazon-ssm-agent-3.3.5226.0-1.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.5226.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11694-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20702-1 No score

Security update for trivy

This update for trivy fixes the following issues:

Changes in trivy:

  • Update to version 0.70.0 ( bsc#1260193, CVE-2026-33186, bsc#1260971, CVE-2026-33747, bsc#1261052, CVE-2026-33748, bsc#1262389, CVE-2026-39984, bsc#1262893, CVE-2026-34986):
    • release: v0.70.0 [main] (#10105)
    • chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#10496)
    • chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#10526)
    • chore(deps): bump the common group across 1 directory with 8 updates (#10540)
    • chore(deps): bump the docker group across 1 directory with 2 updates (#10538)
    • fix: use Development category for GoReleaser discussions (#10530)
    • chore(deps): bump testcontainers-go to v0.42.0 (#10531)
    • chore: update CODEOWNERS (#10529)
    • chore(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 (#10511)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#10510)
    • chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 (#10449)
    • ci: migrate from mkdocs-material-insiders to mkdocs-material (#10509)
    • chore: remove aquasecurity/homebrew-trivy tap from GoReleaser (#10508)
    • ci: update runners for workflows that interact with GitHub API (#10502)
    • ci: rename tokens and update runners (#10500)
    • ci: trigger helm chart publishing via helm-charts workflow (#10474)
    • ci: remove ruleset update step from release-please workflow (#10499)
    • ci: use large runner and replace ORG_REPO_TOKEN in release-please workflow (#10498)
    • ci: trigger rpm/deb deployment via trivy-repo workflow (#10476)
    • fix: remove os.Stdout from wazero module config (#10403)
    • chore(deps): bump the common group across 1 directory with 22 updates (#10408)
    • chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#10407)
    • fix(flag): validate template file extension (#10296)
    • fix(sbom): preserve Red Hat BuildInfo when scanning SBOMs without layer info (#10378)
    • fix: handle Go 1.26 GOEXPERIMENT version format change (#10351)
    • fix(python): handle multiple version specifiers in requirements.txt (#10361)
    • ci: run Trivy version bump in trivy-action (#10272)
    • fix(python): nil pointer dereference with optional poetry groups without dependencies (#10359)
    • ci: replace personal email with github-actions[bot] in workflows (#10369)
    • chore: replace smithy epoch parsing with stdlib time.Unix (#10286)
    • test: update golden files for purl changes (#10372)
    • ci: add zizmor to scan GitHub Actions workflows (#10322)
    • refactor: log statuses as strings (#10285)
    • ci: add build provenance attestations for release artifacts (#10316)
    • fix(sbom): add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages (#10368)
    • fix(report): set correct sarif ROOTPATH uri when scanning a git repository (#10366)
    • perf(plugin): optimize directory traversal by replacing filepath.Walk with filepath.WalkDir (#10325)
    • docs: correct typos in CHANGELOG and diagram (#10320)
    • chore: delete roadmap wf (#10295)
    • ci(helm): bump Trivy version to 0.69.3 for Trivy Helm Chart 0.21.3 (#10310)
    • fix(cyclonedx): include CVSS v4 vulnerability ratings (#10313)
    • fix: detected vulnerability fields in azure and mariner detector (#10275)
    • ci: add persist-credentials: false to checkout steps (#10306)
    • ci(helm): bump Trivy version to 0.69.2 for Trivy Helm Chart 0.21.2 (#10270)
    • chore(deps): bump the common group across 1 directory with 8 updates (#10248)
    • chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#10257)
    • chore(deps): bump the aws group across 1 directory with 6 updates (#10249)
    • chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#10241)
    • ci: remove apidiff workflow (#10259)
    • chore(deps): bump github.com/docker/cli from 29.1.4+incompatible to 29.2.1+incompatible in the docker group across 1 directory (#10221)
    • ci: bump golangci-lint to v2.10 in…
Record
openSUSE-SU-2026:20702-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20752-1 No score

Security update for alloy

This update for alloy fixes the following issues

Security issues:

  • CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).

Non security issue:

  • Updated to 1.16.0
  • Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)
Record
openSUSE-SU-2026:20752-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20809-1 No score

Security update for trivy

This update for trivy fixes the following issues

  • CVE-2025-64702: github.com/quic-go/quic-go/http3: quic-go HTTP/3 QPACK Header Expansion DoS (bsc#1255366).
  • CVE-2025-69725: github.com/go-chi/chi/v5: incorrect input validation in the RedirectSlashes function can lead to an open redirect (bsc#1258513).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258094).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260193).
  • CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written outside of the BuildKit state directory (bsc#1260971).
  • CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository (bsc#1261052).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262893).
  • CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262389).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264873).

Changes for trivy:

  • Updated go-git to 5.18.0.
  • Updated to version 0.70.0.
Record
openSUSE-SU-2026:20809-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21079-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
openSUSE-SU-2026:21079-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:0757-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260226T182644 2026-02-26T18:26:44Z (jsc#PED-11136) Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-4259 CVE-2025-13767 GHSA-fmqf-pmcm-8cx9
  • GO-2025-4260 CVE-2025-64641 GHSA-vww6-79rv-3j4x
  • GO-2026-4282 CVE-2017-18873 GHSA-x6mw-hf2j-vqpc
  • GO-2026-4305 CVE-2017-18903 GHSA-fcwg-45jh-5qhf
  • GO-2026-4325 CVE-2025-14822 GHSA-9r42-rhw3-2222
  • GO-2026-4326 CVE-2025-14435 GHSA-mx8m-v8qm-xwr8
  • GO-2026-4332 CVE-2026-23644 GHSA-2657-3c98-63jq
  • GO-2026-4348 CVE-2026-23991 GHSA-846p-jg2w-w324
  • GO-2026-4349 CVE-2026-23992 GHSA-fphv-w9fq-2525
  • GO-2026-4377 CVE-2026-24686 GHSA-jqc5-w2xx-5vq4
  • GO-2026-4410 CVE-2026-25140 GHSA-f4w5-5xv9-85f6
  • GO-2026-4502 CVE-2026-25766 GHSA-pgvm-wxw2-hrv9
  • GO-2026-4534 CVE-2026-25899 GHSA-2mr3-m5q5-wgp6
  • GO-2026-4535 CVE-2026-27585 GHSA-4xrr-hq4w-6vf4
  • GO-2026-4536 CVE-2026-27590 GHSA-5r3v-vc8m-m96g
  • GO-2026-4537 CVE-2026-27589 GHSA-879p-475x-rqh2
  • GO-2026-4538 CVE-2026-27587 GHSA-g7pc-pc7g-h8jh
  • GO-2026-4539 CVE-2026-27586 GHSA-hffm-g8v7-wrv7
  • GO-2026-4540 CVE-2026-25891 GHSA-m3c2-496v-cw3v
  • GO-2026-4541 CVE-2026-27588 GHSA-x76f-jf84-rqj8
  • GO-2026-4543 CVE-2026-25882 GHSA-mrq8-rjmw-wpq3
  • GO-2026-4559 CVE-2026-27141

Update to version 0.0.20260225T230704 2026-02-25T23:07:04Z.

  • GO-2026-4358 CVE-2026-24137 GHSA-fcv2-xgw5-pqxf
  • GO-2026-4361 GHSA-c32p-wcqj-j677
  • GO-2026-4394 CVE-2026-24051 GHSA-9h8m-3fm2-qjrq
  • GO-2026-4399 CVE-2026-25518 GHSA-gx3x-vq4p-mhhv
  • GO-2026-4507 CVE-2026-26314 GHSA-2gjw-fg97-vg3r
  • GO-2026-4508 CVE-2026-26313 GHSA-689v-6xwf-5jf3
  • GO-2026-4509 CVE-2026-27017 GHSA-7m29-f4hw-g2vx
  • GO-2026-4511 CVE-2026-26315 GHSA-m6j8-rg6r-7mv8
  • GO-2026-4512 CVE-2026-26995 GHSA-rrxv-pmq9-x67r
  • GO-2026-4531 CVE-2026-25591 GHSA-w6x6-9fp7-fqm4
  • GO-2026-4532 CVE-2026-25802 GHSA-299v-8pq9-5gjq
  • GO-2026-4533 CVE-2026-27571 GHSA-qrvq-68c2-7grw
  • GO-2026-4542 CVE-2026-27598 GHSA-6v48-fcq6-ff23
  • GO-2026-4545 CVE-2025-50180 GHSA-3c9r-837r-qqm4
  • GO-2026-4546 CVE-2026-27611 GHSA-8vrh-3pm2-v4v6
  • GO-2026-4547 CVE-2026-27626 GHSA-49gm-hh7w-wfvf
  • GO-2026-4548 GHSA-2phg-qgmm-r638

Update to version 0.0.20260223T182315 2026-02-23T18:23:15Z.

  • GO-2026-4392 CVE-2026-24845 GHSA-9m43-p3cx-w8j5
  • GO-2026-4434 CVE-2023-43635 GHSA-4jvr-vj2c-8q37
  • GO-2026-4435 CVE-2023-43636 GHSA-5h7v-g49c-h887
  • GO-2026-4436 CVE-2023-43637 GHSA-g7vp-j25f-h34p
  • GO-2026-4442 GHSA-x9p2-77v6-6vhf
  • GO-2026-4444 CVE-2026-23989 GHSA-9j2f-3rj3-wgpg
  • GO-2026-4445 CVE-2026-25760 GHSA-2286-hxv5-cmp2
  • GO-2026-4446 CVE-2026-24851 GHSA-jq9f-gm9w-rwm9
  • GO-2026-4447 GHSA-vf5j-r2hw-2hrw
  • GO-2026-4448 CVE-2025-64111 GHSA-gg64-xxr9-qhjp
  • GO-2026-4449 CVE-2025-64175 GHSA-p6x6-9mx6-26wj
  • GO-2026-4450 CVE-2026-23632 GHSA-5qhx-gwfj-6jqr
  • GO-2026-4451 CVE-2026-22592 GHSA-cr88-6mqm-4g57
  • GO-2026-4452 CVE-2026-24135 GHSA-jp7c-wj6q-3qf2
  • GO-2026-4453 CVE-2026-23633 GHSA-mrph-w4hh-gx3g
  • GO-2026-4454 GHSA-26gq-grmh-6xm6
  • GO-2026-4455 CVE-2025-70963 GHSA-9f8m-9547-2gqm
  • GO-2026-4456 CVE-2025-13523 GHSA-ffx7-34p2-vm3w
  • GO-2026-4457 CVE-2025-65852 GHSA-rjv5-9px2-fqw6
  • GO-2026-4458 CVE-2026-25793 GHSA-69x3-g4r3-p962
  • GO-2026-4459 CVE-2017-18907 GHSA-42x9-rr3c-gr59
  • GO-2026-4460 CVE-2017-18918 GHSA-5ghq-28r7-qwfj
  • GO-2026-4461 CVE-2026-25804 GHSA-86x4-wp9f-wrr9
  • GO-2026-4462 CVE-2017-18915 GHSA-hxxj-8phw-74vw
  • GO-2026-4463 CVE-2017-18917 GHSA-jxc4-w54c-qv5r
  • GO-2026-4464 CVE-2017-18911 GHSA-m462-mqw4-2c8m
  • GO-2026-4465 GHSA-vhvq-fv9f-wh4q
  • GO-2026-4466 CVE-2026-25791 GHSA-wxrw-gvg8-fqjp
  • GO-2026-4467 CVE-2017-18916 GHSA-x33g-375j-jhf7
  • GO-2026-4471 CVE-2025-66630 GHSA-68rr-p4fp-j59v
  • GO-2026-4473 CVE-2026-25934 GHSA-37cx-329c-33x3
  • GO-2026-4474 CVE-2026-25890 GHSA-4mh3-h929-w968
  • GO-2026-4475 CVE-2026-25889 GHSA-hxw8-4h9j-hq2r
  • GO-2026-4476 CVE-2017-18908…
Record
SUSE-SU-2026:0757-1
Updated
2026-11-02
OSVSUSE-SU-2026:1411-1 No score

Security update for terraform-provider-local, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-local, terraform-provider-random, terraform-provider-tls fixes the following issue:

  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files that can lead to the consumption of corrupted files (bsc#1258097).
  • CVE-2026-33186: fix authorization bypass in grpc-go due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260218)
Record
SUSE-SU-2026:1411-1
Updated
2026-11-02
OSVSUSE-SU-2026:21793-1 No score

Security update for alloy

This update for alloy fixes the following issues

Security issues:

  • CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).

Non security issue:

  • Updated to 1.16.0
  • Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)
Record
SUSE-SU-2026:21793-1
Updated
2026-11-02
OSVSUSE-SU-2026:22157-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
SUSE-SU-2026:22157-1
Updated
2026-11-02
OSVSUSE-SU-2026:2438-1 No score

Security update for alloy

This update for alloy fixes the following issues

Security issues:

  • CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
  • CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Non security issue:

  • Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
  • Update to version 1.16.1
  • Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby
  • Use latest openSUSE Tumbleweed image for building web UI assets
  • Install nvm to set node version specified upstream
  • update to 1.16.0:
  • Features
  • Add clustering for loki.source.kubernetes_events (#6027) (3dbf587) (@petewall)
  • Add otelcol.auth.google client auth provider (#5526) (da99a66) (@dashpole, @clayton-cornell)
  • beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
  • database_observability: Add support for GCP Cloud SQL metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
  • database_observability: Make targets optional (#5924) (54664b2) (@matthewnolf)
  • database_observability: Update default excluded schemas and users (#6080) (b386fff) (@cristiangreco)
  • faro.receiver: Add sourcemap fetching from remote locations (#4614) (b6cb5da) (@Oxel40)
  • helm: Add support for global.image.pullPolicy (#6069) (2e2ce72) (@petewall)
  • helm: Allow configuring image pull policy for config reloader (#5923) (991539b) (@kalleep)
  • loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
  • loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#5855) (053a2f7) (@kleimkuhler)
  • loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#5909) (c16a660) (@mikefat)
  • loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#5970) (b16decb) (@kleimkuhler)
  • Oracle exporter can scrape more than one DB (#6008) (6fbad38) (@ptodev)
  • prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
  • prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#5836) (4f49b57) (@cristiangreco)
  • prometheus.remote_write: Sync WAL with upstream Prometheus (#5907) (e74a91b) (@x1unix)
  • pyroscope: Add support for extra async-profiler CLI arguments (#5472) (9251e33) (@ivanape)
  • pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
  • pyroscope: Update debuginfo client for HTTP/1.1 upload API (#6037) (879d8e5) (@korniltsev-grafanista)
  • Change service stop command from 'sc' to 'net' (#5906) (450973d) (@mateuszdrab)
  • database_observability.mysql: Refactor explain plan loop batch size (#5894) (f0fcd6b) (@cristiangreco)
  • database_observability.postgres: Cleanup embedded exporter collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
  • database_observability.postgres: Fix EXPLAIN param count when placeholders repeat (#6082) (b612b81) (@rgeyer)
  • database_observability: Drop schema_detection from logs (#6076) (b0105cb) (@cristiangreco) -…
Record
SUSE-SU-2026:2438-1
Updated
2026-11-02
OSVSUSE-SU-2026:2467-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
SUSE-SU-2026:2467-1
Updated
2026-11-02
OSVSUSE-SU-2026:2468-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
SUSE-SU-2026:2468-1
Updated
2026-11-02
OSVSUSE-SU-2026:3056-1 No score

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

  • CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
  • CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
  • CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
  • CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
  • CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
  • CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
  • CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
  • CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
  • CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
  • CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
  • CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
  • CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
  • CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…
Record
SUSE-SU-2026:3056-1
Updated
2026-11-02
OSVUSN-8088-1 No score

golang-github-go-git-go-git vulnerabilities

Ionut Lalu discovered that go-git incorrectly handled certain specially crafted Git server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-49568, CVE-2025-21614)

Ionut Lalu discovered that go-git incorrectly handled file system paths when using the ChrootOS implementation. A remote attacker could possibly use this issue to perform a path traversal and create or modify arbitrary files, leading to remote code execution. (CVE-2023-49569)

It was discovered that go-git did not properly sanitize arguments when invoking git-upload-pack using the file transport protocol. An attacker could possibly use this issue to inject arbitrary flag values when interacting with local Git repositories. (CVE-2025-21613)

It was discovered that go-git did not properly verify integrity checks for pack and index files. An attacker could possibly use this issue to cause go-git to process corrupted repository data, resulting in unexpected errors or an incorrect repository state. (CVE-2026-25934)

Record
USN-8088-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/go-git/go-git/v5
Go
 through 5.16.4
5.16.5
golang-github-go-git-go-git
Debian:12
 All versions, plus listed versions
5.11.0-15.11.0-25.11.0-35.11.0-45.12.0-1
Show 9 moreShow less
5.13.2-15.14.0-15.16.2-15.17.0-15.17.1-15.19.1-15.19.2-15.4.2-35.4.2-4
 None known
golang-github-go-git-go-git
Debian:13
 All versions, plus listed versions
5.14.0-15.16.2-15.17.0-15.17.1-15.19.1-15.19.2-1
 None known
golang-github-go-git-go-git
Debian:14
 before 5.17.0-1, plus listed versions
5.14.0-15.16.2-1
5.17.0-1
github.com/go-git/go-git/v5
Go
 before 5.16.5
5.16.5
github.com/go-git/go-git
Go
 All versions None known
github.com/go-git/go-git/v4
Go
 All versions None known
govulncheck-vulndb
openSUSE:Leap 15.6
 before 0.0.20260226T182644-150000.1.149.1
0.0.20260226T182644-150000.1.149.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.8.1
2.0.0-150200.6.8.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.12.1
3.0.0-150200.6.12.1
Show 48 moreShow less
Affected packages
PackageAffectedFixed
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.6.2
3.0.0-150200.6.6.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.5.6.2
3.0.0-150200.5.6.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.8.1
2.0.0-150200.6.8.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.12.1
3.0.0-150200.6.12.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.6.2
3.0.0-150200.6.6.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.5.6.2
3.0.0-150200.5.6.2
terraform-provider-local
openSUSE:Leap 15.6
 before 2.0.0-150200.6.8.1
2.0.0-150200.6.8.1
terraform-provider-null
openSUSE:Leap 15.6
 before 3.0.0-150200.6.12.1
3.0.0-150200.6.12.1
terraform-provider-random
openSUSE:Leap 15.6
 before 3.0.0-150200.6.6.2
3.0.0-150200.6.6.2
terraform-provider-tls
openSUSE:Leap 15.6
 before 3.0.0-150200.5.6.2
3.0.0-150200.5.6.2
amazon-ssm-agent
SUSE:Linux Enterprise Server 16.0
 before 3.3.4624.0-160000.1.1
3.3.4624.0-160000.1.1
amazon-ssm-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.3.4624.0-160000.1.1
3.3.4624.0-160000.1.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.16.1-150700.15.20.1
1.16.1-150700.15.20.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 3.3.4624.0-4.49.1
3.3.4624.0-4.49.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
golang-github-go-git-go-git
Ubuntu:Pro:22.04:LTS
 before 5.4.2-3ubuntu0.1~esm1, plus listed versions
5.4.2-3
5.4.2-3ubuntu0.1~esm1
golang-github-go-git-go-git
Ubuntu:Pro:24.04:LTS
 before 5.4.2-4ubuntu0.24.04.3+esm2, plus listed versions
5.4.2-3build15.4.2-45.4.2-4ubuntu0.24.04.15.4.2-4ubuntu0.24.04.25.4.2-4ubuntu0.24.04.2+esm15.4.2-4ubuntu0.24.04.35.4.2-4ubuntu0.24.04.3+esm1
5.4.2-4ubuntu0.24.04.3+esm2
golang-github-go-git-go-git
Ubuntu:25.10
 All versions, plus listed versions
5.14.0-1
 None known
golang-github-go-git-go-git
Ubuntu:26.10
 All versions, plus listed versions
5.16.2-15.19.1-15.19.2-1
 None known
golang-github-go-git-go-git
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.14.0-15.16.2-15.16.2-1ubuntu0.1~esm1
 None known
alloy
openSUSE:Tumbleweed
 before 1.15.1-1.1
1.15.1-1.1
trivy
openSUSE:Tumbleweed
 before 0.70.0-1.1
0.70.0-1.1
amazon-ssm-agent
openSUSE:Tumbleweed
 before 3.3.5226.0-1.1
3.3.5226.0-1.1
amazon-ssm-agent
openSUSE:Leap 16.0
 before 3.3.4624.0-160000.1.1
3.3.4624.0-160000.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,642 references and the rest of 9 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open