CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

A vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

A vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line,…

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56853 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Previously, this was being done with no timeout applied. ReadHeaderTimeout is now applied for this. CVE-2026-56860 Previously, resolving relative paths containing parent directory (|..|) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. CVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. CVE-2026-56862 Previously, we always counted handshake messages, such as KeyUpdate, as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. CVE-2026-56858 Previously, pathological inputs could close an unescaped |/| early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returned the name "example.com" rather than an error. CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the flannel-0.28.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for kubevirt1.8 fixes the following issues:

Update to version 1.8.4.

Security issues fixed:

• CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification (bsc#1269093).
• CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).
• CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267120).
• CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted SETTINGS_MAX_FRAME_SIZE can lead to an infinite loop and a denial of service (bsc#1265736).
• CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame parser allows for a denial of service via crafted SPDY frames (bsc#1262265).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266575).
• CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in x/crypto/ssh (bsc#1266151).
• CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer can lead to panic (bsc#1273606).
• CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272011).

Other updates and bugfixes:

• Fix the release manifests' image references (bsc#1272604).
• Add a libguestfs-tools subpackage.
• Build with Go >= 1.25 (required by golang.org/x/net 0.55).
• Version 1.8.4:
  • node-labeller: use new libvirt flags for full feature expansion.
  • Fix gRPC connection leak in GetLauncherClient; clean up ghost launcher record on connection setup failure.
  • api: validate VMI VSOCK CID and checksum status fields as uint32.
  • virt-operator: refine canary flow to fully support out-of-band changes.
  • New virt-api/virt-handler/virt-operator ready and down metrics, alerts and recording rules.
• Refresh disks-images-provider.yaml to the v1.8.4 image tag.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5026 CVE-2026-39821
  • GO-2026-6225
  • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
  • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
  • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
  • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
  • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
  • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
  • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
  • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
  • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
  • GO-2026-6262 GHSA-22w5-2fxg-vrwx
  • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
  • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
  • GO-2026-6265 GHSA-8fxq-53rx-ph5f
  • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
  • GO-2026-6267 GHSA-h58c-xccx-75m3
  • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
  • GO-2026-6269 GHSA-rxhg-vcww-2mpw
  • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
  • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
  • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
  • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
  • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
  • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
  • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
  • GO-2026-6278 GHSA-w67g-5rqw-f597
  • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
  • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
  • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
  • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
  • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
  • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
  • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
  • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
  • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
  • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
  • GO-2026-6289 GHSA-w8j7-39hp-8x59
  • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
  • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
  • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
  • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
  • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
  • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
  • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
  • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
  • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
  • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
  • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
  • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

• Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4720 GHSA-v3mg-9v85-fcm7
  • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
  • GO-2026-4950
  • GO-2026-6093 GHSA-464c-974j-9xm6
  • GO-2026-6094 GHSA-gcjh-h69q-9w9g
  • GO-2026-6095 GHSA-r277-6w6q-xmqw
  • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
  • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
  • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
  • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
  • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
  • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
  • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
  • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
  • GO-2026-6105 GHSA-c534-2w9c-x7fm
  • GO-2026-6106 GHSA-v6w6-358x-2433
  • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
  • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
  • GO-2026-6109 GHSA-86cx-wwf4-phq4
  • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
  • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
  • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
  • GO-2026-6113 GHSA-p6ph-3jx2-3337
  • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
  • GO-2026-6115 CVE-2026-56867
  • GO-2026-6117 GHSA-hp74-gm6m-2qm5
  • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
  • GO-2026-6119 CVE-2026-43983…

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.75.1: (boo#1279548)
  • Security
    • archive
      • Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)
      • Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    • build
      • Fix multiple CVEs by upgrading to go1.26.6 (Nick Craig-Wood)
        • CVE-2026-56860: net/url: quadratic complexity in resolvePath
        • CVE-2026-56858: html/template: JavaScript regexp context tracking
        • CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
        • CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
        • CVE-2026-56859: encoding/xml: recursion depth guard during decode
        • CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
        • CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
        • CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
      • Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs (Nick Craig-Wood)
        • CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
        • CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
        • CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
      • Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603 (Nick Craig-Wood)
        • CVE-2026-46603: excessive memory allocation during VP8L decoding
      • fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick Craig-Wood)
      • fshttp: Don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
      • http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
      • lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
      • local
        • Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
        • Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
        • Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)
      • serve docker
        • Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
        • Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
        • Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
      • serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)
      • serve s3
        • Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)
        • Reject bogus multipart part sizes in the reorder…

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

Root has patched CVE-2026-46600 in the golang.org/x/net package for Root:Go. Multiple fixed versions available.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5026 CVE-2026-39821
  • GO-2026-6225
  • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
  • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
  • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
  • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
  • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
  • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
  • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
  • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
  • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
  • GO-2026-6262 GHSA-22w5-2fxg-vrwx
  • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
  • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
  • GO-2026-6265 GHSA-8fxq-53rx-ph5f
  • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
  • GO-2026-6267 GHSA-h58c-xccx-75m3
  • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
  • GO-2026-6269 GHSA-rxhg-vcww-2mpw
  • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
  • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
  • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
  • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
  • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
  • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
  • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
  • GO-2026-6278 GHSA-w67g-5rqw-f597
  • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
  • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
  • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
  • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
  • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
  • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
  • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
  • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
  • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
  • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
  • GO-2026-6289 GHSA-w8j7-39hp-8x59
  • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
  • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
  • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
  • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
  • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
  • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
  • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
  • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
  • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
  • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
  • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
  • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

• Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4720 GHSA-v3mg-9v85-fcm7
  • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
  • GO-2026-4950
  • GO-2026-6093 GHSA-464c-974j-9xm6
  • GO-2026-6094 GHSA-gcjh-h69q-9w9g
  • GO-2026-6095 GHSA-r277-6w6q-xmqw
  • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
  • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
  • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
  • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
  • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
  • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
  • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
  • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
  • GO-2026-6105 GHSA-c534-2w9c-x7fm
  • GO-2026-6106 GHSA-v6w6-358x-2433
  • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
  • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
  • GO-2026-6109 GHSA-86cx-wwf4-phq4
  • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
  • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
  • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
  • GO-2026-6113 GHSA-p6ph-3jx2-3337
  • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
  • GO-2026-6115 CVE-2026-56867
  • GO-2026-6117 GHSA-hp74-gm6m-2qm5
  • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
  • GO-2026-6119 CVE-2026-43983…

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for kubevirt fixes the following issues:

• Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree:

  • CVE-2026-39821 (bsc#1266575): the previous entry claimed this fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's idna fix is compile-time gated on Unicode 16 tables, which only exist for go1.27+ - it is inert in our go1.25 builds, so the claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -> v0.57.0, whose idna package rejects all-ASCII Punycode labels unconditionally; the CVE is now actually fixed.

• Re-vendor golang.org/x/text v0.37.0 -> v0.40.0: CVE-2026-56852 (bsc#1271661), infinite loop on invalid input in unicode/norm.

• golang.org/x/crypto v0.52.0 -> v0.54.0 (pulled in by x/net 0.57.0; no additional CVE claims, all previously listed x/crypto fixes remain included).

• CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last component is a symlink without detecting it, allowing metadata operations via /proc/self/fd to act on the symlink target. Backports of upstream release-1.7 commits 9ecda4ad5e and 1494cee849.

• x/net 0.57.0 also contains the fix for CVE-2026-46600 (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that package (not affected), the bump merely rides past it.

This update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 fixes the following issues:

• CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic complexity when parsing HTML documents allow for denial of service (bsc#1251420).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: no validation of message size when processing new identity requests can cause a panic due to an out-of-bounds read (bsc#1254014).
• CVE-2025-58181: golang.org/x/crypto/ssh: no validation of number of mechanisms in GSSAPI authentication requests can cause unbounded memory consumption (bsc#1253935).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input can lead to a denial of service (bsc#1251615).
• CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification (bsc#1269093).
• CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267120).
• CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted SETTINGS_MAX_FRAME_SIZE can lead to an infinite loop and a denial of service (bsc#1265736).
• CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame parser allows for a denial of service via crafted SPDY frames (bsc#1262265).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266575).
• CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer can lead to panic (bsc#1273606).
• CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272000).

Other updates and bugfixes:

• Fixed printf-style calls with non-constant format strings (cmd/virt-chroot, tests/) that fail go1.25's vet (toolchain required by the x/net 0.55.0 re-vendor); rewritten with no behavior change.
• Build with Go >= 1.25 (required by golang.org/x/net 0.55).

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

• Update to version 1.19.2.
• Update to version 1.19.1.
• Update to version 1.19.0:

• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans

• Update to version 1.18.1:

• Add nop receiver to OTel Engine