CVE-2026-39828

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ssm-agent-3.3.4624.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

Changes in trivy:

• update x/crypto to 0.52.0 (bsc#1266075, CVE-2026-39827, CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831, CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832, CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (bsc#1266202) Update golang.org/x/crypto to v0.52.0

• Fix CVE-2026-33814 GO-2026-4918 (bsc#1265844) Update golang.org/x/net to version v0.53.0

• Integrate vulnchecker into %check stage (optional).

• Sync with Factory version which also fixes CVE-2024-45310 tracked in bsc#1257432

• Readded SLE-15SP6.def as it was removed from Factory

This update for hauler fixes the following issues:

Changes in hauler:

• update x/crypto to 0.52.0 (bsc#1266167, CVE-2026-39827, CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831, CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832, CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)

• update x/net to v0.53.0 to address CVE-2026-33814 (bsc#1265765)

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• golang.org/x/crypto/ssh: Fixed multiple issues: CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)

• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (boo#1266596).

• Update to version 6.6.2

  • Improve git default branch handling

• CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)

• Switch to go1.25 as required by update go image library.

• Update to version 6.6.0

  • Various bug fixes and performance improvements

• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258591).

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254023).

• CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253864).

• CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).

• Update to version 6.5.1

  • Fix team deletion not working
  • Chat attachments improvements
  • Miscellaneous bugfixes

This update for trivy fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267047).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265648).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266495).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266075).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).

Changes for trivy:

• Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):

• release: v0.71.0 [main] (#10638)
• ci: use only the first line of commit message in release-please workflow (#10766)
• feat: add WithDriver and WithProvider options to ospkg detector (#10740)
• chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
• refactor(secret): normalize configPath once in Init (#10702)
• feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704)
• chore(deps): bump the common group across 1 directory with 25 updates (#10758)
• chore: migrate from gomodguard to gomodguard_v2 (#10739)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)
• ci: scope GitHub App tokens to minimum required permissions (#10755)
• chore(deps): upgrade go-redis from v8 to v9 (#10736)
• fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
• fix(misconf): skip resources with no after changes (#10352)
• fix(misconf): reject nil plays during playbook parsing (#10273)
• fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
• fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
• refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
• chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
• fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
• fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions…

This update for google-guest-agent fixes the following issues

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).

Changes for google-guest-agent:

• Update to version 20260529.00

• Dependency updates (#616)

• from version 20260522.00

• Fix improper umask calculation on socket creation (#614)

• from version 20260520.01

• Update OWNERS (#609)
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)

• Update to version 20250506.01 (bsc#1243254, bsc#1243505)

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for distribution fixes the following issues

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
• CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266049).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).

Changes:

• Bounds-check the file basename in PurgeUploads Walk callback
• Add S3 Express One Zone support to the S3 storage driver
• Fix tag list endpoint in proxy mode
• Clamp oversized n query parameter in proxy mode instead of returning 400
• See the full changelog below for the full list of changes.
• internal/client/auth/challenge: cleanups and minor refactor
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
• chore(build): Bump go version to latest
• refactor: use slices.Backward to simplify the code
• fix(proxy): fix tag list endpoint in proxy mode
• Update docker-compose structure in deploying.md
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0
• build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
• fix(proxy): clamp oversized n query param instead of
• feat(s3): add express zone one support to S3 driver
• fix(storage): bounds-check the file basename in PurgeUploads Walk callback
• chore(release): prepare for v3.1.1 release

This update for mcphost fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267109).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265730).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266572).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266145).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).

This update for google-osconfig-agent fixes the following issues

• CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

• Update to version 20260615.01

• Upgrade golang.org/x/crypto & golang.org/x/net (#1006)

• from version 20260615.00

• Add unit tests for ospatch_apt_upgrade.go (#938)

• Update to version 20260611.00

• Add unit tests for policies/policies.go PART 5 (#998)

• from version 20260610.00

• Add unit tests for policies/policies.go PART 4 (#997)

• from version 20260609.02

• squash commits (#936)

• from version 20260609.01

• Add unit tests for policies/policies.go PART 3 (#996)

• from version 20260609.00

• Add unit tests for policies/policies.go PART 2 (#991)

• from version 20260602.01

• Align format of dates and timestamp collected across Windows packages (#973)

• from version 20260602.00

• Add unit tests for config/config,go (#979)

• from version 20260528.00

• Bump github.com/containerd/containerd (#990)

• from version 20260521.00

• Cover agentconfig functionality by unit tests (#925)

• from version 20260520.04

• Add unit tests for policies/googet.go (#961)
• Bump github.com/go-git/go-git/v5 (#987)

• from version 20260520.02

• Add unit tests for policies/yum.go (#952)
• Add unit tests for policies/apt.go PART 3 (#951)

• from version 20260520.00

• Add unit tests for policies/zypper.go (#953)

• from version…

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for alloy fixes the following issues:

Update to version 1.17.0.

Security issues fixed:

• CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service (bsc#1267185).
• CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a RangeError due to a stack overflow and cause to a denial of service (bsc#1260981).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected by the server can cause unbounded memory growth and a crash (bsc#1266196).
• CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns PartialSuccessError with non-nil permissions (bsc#1266196).
• CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).
• CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a connection's read loop and cause a resource leak (bsc#1266196).
• CVE-2026-39831: golang.org/x/crypto/ssh: missing User Presence flag checks in the Verify() method for FIDO/U2F security key types cause signatures generated without physical touch to be accepted (bsc#1266196).
• CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and allow for unrestricted use of a key on a remote host (bsc#1266196).
• CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it (bsc#1266196).
• CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single Write call on an SSH channel leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).
• CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can lead to a panic (bsc#1266196).
• CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an SQL query can lead to a SQL injection (bsc#1265440).
• CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42508: golang.org/x/crypto/ssh: revoked SignatureKeys belonging to a CA are not correctly checked for revocation (bsc#1266196).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
• CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
• CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
• CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on…

This update for cosign fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing HTML files (bsc#1267044).
• CVE-2026-33815: memory-safety vulnerability (bsc#1261811).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: Fixed multiple issues in golang.org/x/crypto/ssh. (bsc#1266049).

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.74.4 (boo#1267192):

  • Version v1.74.4
  • gui: update embedded release to 1.1.10
  • local: stop --links symlinks escaping the destination directory CVE-2026-54572
  • local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
  • s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
  • serve restic: fix --private-repos isolation bypass CVE-2026-59733
  • archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
  • serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
  • build: fix multiple CVEs by upgrading to go1.26.5
  • s3: fix mounting a prefix failing with 403 when HEAD is not permitted
  • drive, googlephotos: warn when using rclone's shared client_id #9580
  • drive: fix stray %!(EXTRA) in unexportable google document log message
  • serve/http: fix --disable-zip so it works over rc
  • serve webdav: fix MOVE overwrite failing without Overwrite header
  • fs: fix negative offset when a suffix Range request exceeds object size
  • accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
  • cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
  • cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
  • cmd/mount2: fix NFS file creation by implementing Mknod
  • smb: fix for IBM iSeries and signature verification
  • mega: fix hard deleted files reappearing in listings - fixes #9554
  • mega: wait for server events after upload, delete and move
  • vfs: fix hang reopening a file during the handle-caching grace period
  • s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
  • fs: fix command line flag being ignored when set to its default value
  • docs: fix copy to clipboard functionality for code blocks
  • fs/operations: correct DeleteFile --backup-dir documentation
  • build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
  • docs: clarify copyto command description - Fixes #9527
  • docs: fix typo in remote setup docs
  • serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
  • • s3: fix error mapping in GetObject to match HeadObject
  • filter: fix --files-from copy stopping at the first unreadable file
  • docs: Fix RELEASE.md
  • ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
  • completion: fix powershell completion corrupting non-ASCII names - fixes #9412
  • docs/crypt: fix encrypted size example - Fixes #9202
  • docs: drive: note Google verification exemption for personal use apps
  • rc: document that rc API access is equivalent to shell access
  • docs: drive: update documentation about "Computers" folder
  • accounting: fix goroutine leak in ResetCounters
  • docs: fix --windows-event-log-level help
  • backend/filelu: fix recursive listing path handling and file filtering
  • docs: bisync - clarify flag interaction and minor changes
  • docs: Update RELEASE.md to use cherry-pick -x
  • webdav: fix mixed property statuses in multi-status responses
  • s3: remove session token on cross-host redirects
  • drive: warn when non-exportable Google documents are skipped - #9475
  • Start v1.74.4-DEV development

• update x/image to 0.43 (bsc#1271056)

• Update to version 1.74.3: (boo#1267869)

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for kubevirt1.8 fixes the following issues:

Update to version 1.8.4.

Security issues fixed:

• CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification (bsc#1269093).
• CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).
• CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267120).
• CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted SETTINGS_MAX_FRAME_SIZE can lead to an infinite loop and a denial of service (bsc#1265736).
• CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame parser allows for a denial of service via crafted SPDY frames (bsc#1262265).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266575).
• CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in x/crypto/ssh (bsc#1266151).
• CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer can lead to panic (bsc#1273606).
• CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272011).

Other updates and bugfixes:

• Fix the release manifests' image references (bsc#1272604).
• Add a libguestfs-tools subpackage.
• Build with Go >= 1.25 (required by golang.org/x/net 0.55).
• Version 1.8.4:
  • node-labeller: use new libvirt flags for full feature expansion.
  • Fix gRPC connection leak in GetLauncherClient; clean up ghost launcher record on connection setup failure.
  • api: validate VMI VSOCK CID and checksum status fields as uint32.
  • virt-operator: refine canary flow to fully support out-of-band changes.
  • New virt-api/virt-handler/virt-operator ready and down metrics, alerts and recording rules.
• Refresh disks-images-provider.yaml to the v1.8.4 image tag.

This update for glab fixes the following issues:

Changes in glab:

• Update to version 1.114.0:

  • feat(api): support dynamic custom headers for authenticating proxies
  • feat(artifact-registry): add glab artifact-registry login --docker
  • feat(artifact-registry): resolve artifact registries in the Docker credential helper
  • feat(mr): show source and target branches in view
  • feat(update): detect more install methods for the upgrade nudge
  • fix(cmdutils): resolve same-host SSH remotes to the right account
  • fix(config): resolve YAML alias nodes in hosts config
  • fix(git): detect "no git repository" by exit status, not message text
  • fix: glab can not set group level variable masked or masked and hidden

• CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version (boo#1266614).

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.9.1
  • Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)
  • Propagate edge registration errors over QUIC and fix supervisor error classification
  • Negotiate protected mode during Quick Tunnel provisioning

Root has patched CVE-2026-39828 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.

This update for elemental-toolkit fixes the following issue

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260277).

Changes for elemental-toolkit:

• Update to version 2.1.6:

• Bump golang.org/x/net to v0.55.0 (bsc#1267168)
• Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)
• Update orange flavor
• Install hugo from the OS repositories
• Bump actions/upload-artifact to v7
• Bump actions/cache to v5
• Bump golangci/golangci-lint-action to v9
• Bump github.com/spf13/cobra library
• Bump github.com/jaypipes/ghw library
• Bump github.com/bramvdbogaerde/go-scp library
• Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
• Bump github.com/ulikunitz/xz library
• Do not clean cache on PRs from forks

This update for elemental-toolkit fixes the following issue

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260277).

Changes for elemental-toolkit:

• Update to v2.2.9:

• 0e33b2bc Bump golang.org/x/net to v0.55.0 (bsc#1267168)
• 4f5423b9 Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)

• Update to v2.2.8:

• 3f38ae3e Avoid pulling binaries with curl
• ef3f97a0 Bump golangci/golangci-lint-action to v9
• 34f9ed84 Bump github.com/spf13/cobra library
• dff54d9a Bump github.com/jaypipes/ghw library
• 7b7ba7ac github.com/bramvdbogaerde/go-scp libary
• ac19e71c Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
• 55761782 Bump github.com/ulikunitz/xz library
• d04e480d Update headers to 2026
• bb7974f4 Switch from TW to Leap 16.0 for green flavor

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for distribution fixes the following issues

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
• CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266049).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).

Changes:

• Bounds-check the file basename in PurgeUploads Walk callback
• Add S3 Express One Zone support to the S3 storage driver
• Fix tag list endpoint in proxy mode
• Clamp oversized n query parameter in proxy mode instead of returning 400
• See the full changelog below for the full list of changes.
• internal/client/auth/challenge: cleanups and minor refactor
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
• chore(build): Bump go version to latest
• refactor: use slices.Backward to simplify the code
• fix(proxy): fix tag list endpoint in proxy mode
• Update docker-compose structure in deploying.md
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0
• build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
• fix(proxy): clamp oversized n query param instead of
• feat(s3): add express zone one support to S3 driver
• fix(storage): bounds-check the file basename in PurgeUploads Walk callback
• chore(release): prepare for v3.1.1 release