CVE-2026-39833

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

Changes in trivy:

• update x/crypto to 0.52.0 (bsc#1266075, CVE-2026-39827, CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831, CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832, CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (bsc#1266202) Update golang.org/x/crypto to v0.52.0

• Fix CVE-2026-33814 GO-2026-4918 (bsc#1265844) Update golang.org/x/net to version v0.53.0

• Integrate vulnchecker into %check stage (optional).

• Sync with Factory version which also fixes CVE-2024-45310 tracked in bsc#1257432

• Readded SLE-15SP6.def as it was removed from Factory

This update for hauler fixes the following issues:

Changes in hauler:

• update x/crypto to 0.52.0 (bsc#1266167, CVE-2026-39827, CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831, CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832, CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)

• update x/net to v0.53.0 to address CVE-2026-33814 (bsc#1265765)

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• golang.org/x/crypto/ssh: Fixed multiple issues: CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)

• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (boo#1266596).

• Update to version 6.6.2

  • Improve git default branch handling

• CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)

• Switch to go1.25 as required by update go image library.

• Update to version 6.6.0

  • Various bug fixes and performance improvements

• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258591).

• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254023).

• CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253864).

• CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).

• Update to version 6.5.1

  • Fix team deletion not working
  • Chat attachments improvements
  • Miscellaneous bugfixes

This update for trivy fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267047).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265648).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266495).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266075).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).

Changes for trivy:

• Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):

• release: v0.71.0 [main] (#10638)
• ci: use only the first line of commit message in release-please workflow (#10766)
• feat: add WithDriver and WithProvider options to ospkg detector (#10740)
• chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
• refactor(secret): normalize configPath once in Init (#10702)
• feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704)
• chore(deps): bump the common group across 1 directory with 25 updates (#10758)
• chore: migrate from gomodguard to gomodguard_v2 (#10739)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)
• ci: scope GitHub App tokens to minimum required permissions (#10755)
• chore(deps): upgrade go-redis from v8 to v9 (#10736)
• fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
• fix(misconf): skip resources with no after changes (#10352)
• fix(misconf): reject nil plays during playbook parsing (#10273)
• fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
• fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
• refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
• chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
• fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
• fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions…

This update for google-guest-agent fixes the following issues

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).

Changes for google-guest-agent:

• Update to version 20260529.00

• Dependency updates (#616)

• from version 20260522.00

• Fix improper umask calculation on socket creation (#614)

• from version 20260520.01

• Update OWNERS (#609)
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)

• Update to version 20250506.01 (bsc#1243254, bsc#1243505)

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for distribution fixes the following issues

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
• CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266049).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).

Changes:

• Bounds-check the file basename in PurgeUploads Walk callback
• Add S3 Express One Zone support to the S3 storage driver
• Fix tag list endpoint in proxy mode
• Clamp oversized n query parameter in proxy mode instead of returning 400
• See the full changelog below for the full list of changes.
• internal/client/auth/challenge: cleanups and minor refactor
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
• chore(build): Bump go version to latest
• refactor: use slices.Backward to simplify the code
• fix(proxy): fix tag list endpoint in proxy mode
• Update docker-compose structure in deploying.md
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0
• build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
• fix(proxy): clamp oversized n query param instead of
• feat(s3): add express zone one support to S3 driver
• fix(storage): bounds-check the file basename in PurgeUploads Walk callback
• chore(release): prepare for v3.1.1 release

This update for mcphost fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267109).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265730).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266572).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266145).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).

This update for google-osconfig-agent fixes the following issues

• CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

• Update to version 20260615.01

• Upgrade golang.org/x/crypto & golang.org/x/net (#1006)

• from version 20260615.00

• Add unit tests for ospatch_apt_upgrade.go (#938)

• Update to version 20260611.00

• Add unit tests for policies/policies.go PART 5 (#998)

• from version 20260610.00

• Add unit tests for policies/policies.go PART 4 (#997)

• from version 20260609.02

• squash commits (#936)

• from version 20260609.01

• Add unit tests for policies/policies.go PART 3 (#996)

• from version 20260609.00

• Add unit tests for policies/policies.go PART 2 (#991)

• from version 20260602.01

• Align format of dates and timestamp collected across Windows packages (#973)

• from version 20260602.00

• Add unit tests for config/config,go (#979)

• from version 20260528.00

• Bump github.com/containerd/containerd (#990)

• from version 20260521.00

• Cover agentconfig functionality by unit tests (#925)

• from version 20260520.04

• Add unit tests for policies/googet.go (#961)
• Bump github.com/go-git/go-git/v5 (#987)

• from version 20260520.02

• Add unit tests for policies/yum.go (#952)
• Add unit tests for policies/apt.go PART 3 (#951)

• from version 20260520.00

• Add unit tests for policies/zypper.go (#953)

• from version…

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for alloy fixes the following issues:

Update to version 1.17.0.

Security issues fixed:

• CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service (bsc#1267185).
• CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a RangeError due to a stack overflow and cause to a denial of service (bsc#1260981).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected by the server can cause unbounded memory growth and a crash (bsc#1266196).
• CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns PartialSuccessError with non-nil permissions (bsc#1266196).
• CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).
• CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a connection's read loop and cause a resource leak (bsc#1266196).
• CVE-2026-39831: golang.org/x/crypto/ssh: missing User Presence flag checks in the Verify() method for FIDO/U2F security key types cause signatures generated without physical touch to be accepted (bsc#1266196).
• CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and allow for unrestricted use of a key on a remote host (bsc#1266196).
• CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it (bsc#1266196).
• CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single Write call on an SSH channel leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).
• CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can lead to a panic (bsc#1266196).
• CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an SQL query can lead to a SQL injection (bsc#1265440).
• CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42508: golang.org/x/crypto/ssh: revoked SignatureKeys belonging to a CA are not correctly checked for revocation (bsc#1266196).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
• CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
• CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
• CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on…

This update for cosign fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing HTML files (bsc#1267044).
• CVE-2026-33815: memory-safety vulnerability (bsc#1261811).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: Fixed multiple issues in golang.org/x/crypto/ssh. (bsc#1266049).

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.74.4 (boo#1267192):

  • Version v1.74.4
  • gui: update embedded release to 1.1.10
  • local: stop --links symlinks escaping the destination directory CVE-2026-54572
  • local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
  • s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
  • serve restic: fix --private-repos isolation bypass CVE-2026-59733
  • archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
  • serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
  • build: fix multiple CVEs by upgrading to go1.26.5
  • s3: fix mounting a prefix failing with 403 when HEAD is not permitted
  • drive, googlephotos: warn when using rclone's shared client_id #9580
  • drive: fix stray %!(EXTRA) in unexportable google document log message
  • serve/http: fix --disable-zip so it works over rc
  • serve webdav: fix MOVE overwrite failing without Overwrite header
  • fs: fix negative offset when a suffix Range request exceeds object size
  • accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
  • cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
  • cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
  • cmd/mount2: fix NFS file creation by implementing Mknod
  • smb: fix for IBM iSeries and signature verification
  • mega: fix hard deleted files reappearing in listings - fixes #9554
  • mega: wait for server events after upload, delete and move
  • vfs: fix hang reopening a file during the handle-caching grace period
  • s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
  • fs: fix command line flag being ignored when set to its default value
  • docs: fix copy to clipboard functionality for code blocks
  • fs/operations: correct DeleteFile --backup-dir documentation
  • build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
  • docs: clarify copyto command description - Fixes #9527
  • docs: fix typo in remote setup docs
  • serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
  • • s3: fix error mapping in GetObject to match HeadObject
  • filter: fix --files-from copy stopping at the first unreadable file
  • docs: Fix RELEASE.md
  • ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
  • completion: fix powershell completion corrupting non-ASCII names - fixes #9412
  • docs/crypt: fix encrypted size example - Fixes #9202
  • docs: drive: note Google verification exemption for personal use apps
  • rc: document that rc API access is equivalent to shell access
  • docs: drive: update documentation about "Computers" folder
  • accounting: fix goroutine leak in ResetCounters
  • docs: fix --windows-event-log-level help
  • backend/filelu: fix recursive listing path handling and file filtering
  • docs: bisync - clarify flag interaction and minor changes
  • docs: Update RELEASE.md to use cherry-pick -x
  • webdav: fix mixed property statuses in multi-status responses
  • s3: remove session token on cross-host redirects
  • drive: warn when non-exportable Google documents are skipped - #9475
  • Start v1.74.4-DEV development

• update x/image to 0.43 (bsc#1271056)

• Update to version 1.74.3: (boo#1267869)

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for kubevirt1.8 fixes the following issues:

Update to version 1.8.4.

Security issues fixed:

• CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification (bsc#1269093).
• CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).
• CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267120).
• CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted SETTINGS_MAX_FRAME_SIZE can lead to an infinite loop and a denial of service (bsc#1265736).
• CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame parser allows for a denial of service via crafted SPDY frames (bsc#1262265).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266575).
• CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in x/crypto/ssh (bsc#1266151).
• CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer can lead to panic (bsc#1273606).
• CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272011).

Other updates and bugfixes:

• Fix the release manifests' image references (bsc#1272604).
• Add a libguestfs-tools subpackage.
• Build with Go >= 1.25 (required by golang.org/x/net 0.55).
• Version 1.8.4:
  • node-labeller: use new libvirt flags for full feature expansion.
  • Fix gRPC connection leak in GetLauncherClient; clean up ghost launcher record on connection setup failure.
  • api: validate VMI VSOCK CID and checksum status fields as uint32.
  • virt-operator: refine canary flow to fully support out-of-band changes.
  • New virt-api/virt-handler/virt-operator ready and down metrics, alerts and recording rules.
• Refresh disks-images-provider.yaml to the v1.8.4 image tag.

This update for glab fixes the following issues:

Changes in glab:

• Update to version 1.114.0:

  • feat(api): support dynamic custom headers for authenticating proxies
  • feat(artifact-registry): add glab artifact-registry login --docker
  • feat(artifact-registry): resolve artifact registries in the Docker credential helper
  • feat(mr): show source and target branches in view
  • feat(update): detect more install methods for the upgrade nudge
  • fix(cmdutils): resolve same-host SSH remotes to the right account
  • fix(config): resolve YAML alias nodes in hosts config
  • fix(git): detect "no git repository" by exit status, not message text
  • fix: glab can not set group level variable masked or masked and hidden

• CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version (boo#1266614).

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5026 CVE-2026-39821
  • GO-2026-6225
  • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
  • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
  • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
  • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
  • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
  • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
  • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
  • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
  • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
  • GO-2026-6262 GHSA-22w5-2fxg-vrwx
  • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
  • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
  • GO-2026-6265 GHSA-8fxq-53rx-ph5f
  • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
  • GO-2026-6267 GHSA-h58c-xccx-75m3
  • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
  • GO-2026-6269 GHSA-rxhg-vcww-2mpw
  • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
  • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
  • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
  • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
  • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
  • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
  • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
  • GO-2026-6278 GHSA-w67g-5rqw-f597
  • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
  • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
  • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
  • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
  • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
  • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
  • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
  • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
  • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
  • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
  • GO-2026-6289 GHSA-w8j7-39hp-8x59
  • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
  • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
  • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
  • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
  • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
  • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
  • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
  • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
  • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
  • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
  • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
  • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

• Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4720 GHSA-v3mg-9v85-fcm7
  • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
  • GO-2026-4950
  • GO-2026-6093 GHSA-464c-974j-9xm6
  • GO-2026-6094 GHSA-gcjh-h69q-9w9g
  • GO-2026-6095 GHSA-r277-6w6q-xmqw
  • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
  • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
  • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
  • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
  • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
  • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
  • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
  • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
  • GO-2026-6105 GHSA-c534-2w9c-x7fm
  • GO-2026-6106 GHSA-v6w6-358x-2433
  • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
  • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
  • GO-2026-6109 GHSA-86cx-wwf4-phq4
  • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
  • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
  • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
  • GO-2026-6113 GHSA-p6ph-3jx2-3337
  • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
  • GO-2026-6115 CVE-2026-56867
  • GO-2026-6117 GHSA-hp74-gm6m-2qm5
  • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
  • GO-2026-6119 CVE-2026-43983…

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.9.1
  • Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)
  • Propagate edge registration errors over QUIC and fix supervisor error classification
  • Negotiate protected mode during Quick Tunnel provisioning

Root has patched CVE-2026-39833 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.

This update for elemental-toolkit fixes the following issue

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260277).

Changes for elemental-toolkit:

• Update to version 2.1.6:

• Bump golang.org/x/net to v0.55.0 (bsc#1267168)
• Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)
• Update orange flavor
• Install hugo from the OS repositories
• Bump actions/upload-artifact to v7
• Bump actions/cache to v5
• Bump golangci/golangci-lint-action to v9
• Bump github.com/spf13/cobra library
• Bump github.com/jaypipes/ghw library
• Bump github.com/bramvdbogaerde/go-scp library
• Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
• Bump github.com/ulikunitz/xz library
• Do not clean cache on PRs from forks

This update for elemental-toolkit fixes the following issue

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260277).

Changes for elemental-toolkit:

• Update to v2.2.9:

• 0e33b2bc Bump golang.org/x/net to v0.55.0 (bsc#1267168)
• 4f5423b9 Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)

• Update to v2.2.8:

• 3f38ae3e Avoid pulling binaries with curl
• ef3f97a0 Bump golangci/golangci-lint-action to v9
• 34f9ed84 Bump github.com/spf13/cobra library
• dff54d9a Bump github.com/jaypipes/ghw library
• 7b7ba7ac github.com/bramvdbogaerde/go-scp libary
• ac19e71c Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
• 55761782 Bump github.com/ulikunitz/xz library
• d04e480d Update headers to 2026
• bb7974f4 Switch from TW to Leap 16.0 for green flavor

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
• CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.52.0
• Bump golang.org/x/net from v0.54.0 to v0.55.0
• Enforce directory boundary in BuildSafePath
• Fix visibility issue with Bottlerocket OS in document output
• Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
• Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
• Quit if sysprep failed and log its current state
• Remove attached legacy cloudwatch plugin packages
• Upgrade Go version to 1.25.10
• Use BuildSafePath wherever it is applicable
• Add OOM killer protection to systemd service files
• Apply more sanitation to file and registry inventory gatherers
• Bump go-git to v5.17.1
• Deprecate legacy cloudwatch plugin
• Preserve network error details in credential refresher SSM API failures
• Upgrade Go version to 1.25.9
• Add SSM Distributor support for Bottlerocket OS
• Implement flush credentials command in ssm-cli
• Log ec2messages access denied as debug instead of error to reduce log noise
• Make credential refresher refresh cache quickly…

This update for distribution fixes the following issues

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265788).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266629).
• CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266049).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).

Changes:

• Bounds-check the file basename in PurgeUploads Walk callback
• Add S3 Express One Zone support to the S3 storage driver
• Fix tag list endpoint in proxy mode
• Clamp oversized n query parameter in proxy mode instead of returning 400
• See the full changelog below for the full list of changes.
• internal/client/auth/challenge: cleanups and minor refactor
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
• chore(build): Bump go version to latest
• refactor: use slices.Backward to simplify the code
• fix(proxy): fix tag list endpoint in proxy mode
• Update docker-compose structure in deploying.md
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0
• build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
• fix(proxy): clamp oversized n query param instead of
• feat(s3): add express zone one support to S3 driver
• fix(storage): bounds-check the file basename in PurgeUploads Walk callback
• chore(release): prepare for v3.1.1 release

This update for mcphost fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267109).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265730).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266572).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266145).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).

This update for mcphost fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267109).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265730).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266572).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266145).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).

This update for google-osconfig-agent fixes the following issues

• CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

• Update to version 20260615.01

• Upgrade golang.org/x/crypto & golang.org/x/net (#1006)

• from version 20260615.00

• Add unit tests for ospatch_apt_upgrade.go (#938)

• Update to version 20260611.00

• Add unit tests for policies/policies.go PART 5 (#998)

• from version 20260610.00

• Add unit tests for policies/policies.go PART 4 (#997)

• from version 20260609.02

• squash commits (#936)

• from version 20260609.01

• Add unit tests for policies/policies.go PART 3 (#996)

• from version 20260609.00

• Add unit tests for policies/policies.go PART 2 (#991)

• from version 20260602.01

• Align format of dates and timestamp collected across Windows packages (#973)

• from version 20260602.00

• Add unit tests for config/config,go (#979)

• from version 20260528.00

• Bump github.com/containerd/containerd (#990)

• from version 20260521.00

• Cover agentconfig functionality by unit tests (#925)

• from version 20260520.04

• Add unit tests for policies/googet.go (#961)
• Bump github.com/go-git/go-git/v5 (#987)

• from version 20260520.02

• Add unit tests for policies/yum.go (#952)
• Add unit tests for policies/apt.go PART 3 (#951)

• from version 20260520.00

• Add unit tests for policies/zypper.go (#953)

• from…

This update for google-osconfig-agent fixes the following issues

• CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

• Update to version 20260615.01

• Upgrade golang.org/x/crypto & golang.org/x/net (#1006)

• from version 20260615.00

• Add unit tests for ospatch_apt_upgrade.go (#938)

• Update to version 20260611.00

• Add unit tests for policies/policies.go PART 5 (#998)

• from version 20260610.00

• Add unit tests for policies/policies.go PART 4 (#997)

• from version 20260609.02

• squash commits (#936)

• from version 20260609.01

• Add unit tests for policies/policies.go PART 3 (#996)

• from version 20260609.00

• Add unit tests for policies/policies.go PART 2 (#991)

• from version 20260602.01

• Align format of dates and timestamp collected across Windows packages (#973)

• from version 20260602.00

• Add unit tests for config/config,go (#979)

• from version 20260528.00

• Bump github.com/containerd/containerd (#990)

• from version 20260521.00

• Cover agentconfig functionality by unit tests (#925)

• from version 20260520.04

• Add unit tests for policies/googet.go (#961)
• Bump github.com/go-git/go-git/v5 (#987)

• from version 20260520.02

• Add unit tests for policies/yum.go (#952)
• Add unit tests for policies/apt.go PART 3 (#951)

• from version 20260520.00

• Add unit tests for policies/zypper.go (#953)

• from version…

This update for google-guest-agent fixes the following issues

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).

Changes for google-guest-agent:

• Update to version 20260529.00

• Dependency updates (#616)

• from version 20260522.00

• Fix improper umask calculation on socket creation (#614)

• from version 20260520.01

• Update OWNERS (#609)
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)

• Update to version 20250506.01 (bsc#1243254, bsc#1243505)

This update for google-guest-agent fixes the following issues

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).

Changes:

• Update to version 20260529.00

• Dependency updates (#616)

• from version 20260522.00

• Fix improper umask calculation on socket creation (#614)

• from version 20260520.01

• Update OWNERS (#609)
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)

• Update to version 20250506.01 (bsc#1243254, bsc#1243505)

This update for google-guest-agent fixes the following issues

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).

Changes:

• Update to version 20260529.00

• Dependency updates (#616)

• from version 20260522.00

• Fix improper umask calculation on socket creation (#614)

• from version 20260520.01

• Update OWNERS (#609)
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)

• Update to version 20250506.01 (bsc#1243254, bsc#1243505)

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).