CVE-2026-4427

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

• golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

• golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

• crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

• crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

• net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

• github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

• google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

• github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

• github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

• golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

• crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

• golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

• golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

• crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

• crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

• net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

• github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

• google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

• github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

• github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

• golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

• crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.

These are all security issues fixed in the alloy-1.16.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the teleport-17.7.23-1.1 package on the GA media of openSUSE Tumbleweed.

This update for alloy fixes the following issues

Security issues:

• CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).

Non security issue:

• Updated to 1.16.0
• Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)

This update for alloy fixes the following issues

Security issues:

• CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).

Non security issue:

• Updated to 1.16.0
• Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)

This update for alloy fixes the following issues

Security issues:

• CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
• CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
• CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).
• CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
• CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Non security issue:

• Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
• Update to version 1.16.1

• Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby

• Use latest openSUSE Tumbleweed image for building web UI assets
• Install nvm to set node version specified upstream
• update to 1.16.0:

• Features

• Add clustering for loki.source.kubernetes_events (#6027) (3dbf587) (@petewall)
• Add otelcol.auth.google client auth provider (#5526) (da99a66) (@dashpole, @clayton-cornell)
• beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
• database_observability: Add support for GCP Cloud SQL metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
• database_observability: Make targets optional (#5924) (54664b2) (@matthewnolf)
• database_observability: Update default excluded schemas and users (#6080) (b386fff) (@cristiangreco)
• faro.receiver: Add sourcemap fetching from remote locations (#4614) (b6cb5da) (@Oxel40)
• helm: Add support for global.image.pullPolicy (#6069) (2e2ce72) (@petewall)
• helm: Allow configuring image pull policy for config reloader (#5923) (991539b) (@kalleep)
• loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
• loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#5855) (053a2f7) (@kleimkuhler)
• loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#5909) (c16a660) (@mikefat)
• loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#5970) (b16decb) (@kleimkuhler)
• Oracle exporter can scrape more than one DB (#6008) (6fbad38) (@ptodev)
• prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
• prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#5836) (4f49b57) (@cristiangreco)
• prometheus.remote_write: Sync WAL with upstream Prometheus (#5907) (e74a91b) (@x1unix)
• pyroscope: Add support for extra async-profiler CLI arguments (#5472) (9251e33) (@ivanape)
• pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
• pyroscope: Update debuginfo client for HTTP/1.1 upload API (#6037) (879d8e5) (@korniltsev-grafanista)
• Change service stop command from 'sc' to 'net' (#5906) (450973d) (@mateuszdrab)
• database_observability.mysql: Refactor explain plan loop batch size (#5894) (f0fcd6b) (@cristiangreco)
• database_observability.postgres: Cleanup embedded exporter collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
• database_observability.postgres: Fix EXPLAIN param count when placeholders repeat (#6082) (b612b81) (@rgeyer)
• database_observability: Drop schema_detection from logs (#6076) (b0105cb) (@cristiangreco) -…