CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

These are all security issues fixed in the google-guest-agent-20260903.00-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the google-osconfig-agent-20260908.00-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ssm-agent-3.3.5390.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cloudflared-2026.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apptainer-1.5.3-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-7.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the zk-0.15.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

• CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates (bsc#1258543).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278624).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279390).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1279392).

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
• GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
• GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
• GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
• GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
• GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
• GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
• GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
• GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
• GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
• GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
• GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
• GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
• GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
• GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
• GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
• GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
• GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
• GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
• GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
• GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
• GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
• GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
• GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
• GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
• GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
• GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
• GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
• GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
• GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
• GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
• GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
• GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
• GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
• GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
• GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
• GO-2026-6354 CVE-2026-78662
• GO-2026-6355 CVE-2026-56855

• Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.

• GO-2026-6303 CVE-2026-56854

This update for zk fixes the following issues:

Changes in zk:

• Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447):
  • Upgrade golang.org/x/crypto to v0.56.0 to fix security vulnerabilities in the embedded x/crypto/ssh package:
    • CVE-2026-56854: authentication bypass
    • CVE-2026-56855: deadlock vulnerability
    • CVE-2026-78662: deadlock vulnerability

This update for hauler fixes the following issues:

Changes in hauler:

Update to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for trivy fixes the following issues:

• CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).
• CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).
• CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and denial of service (bsc#1278624).
• CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection deadlocks and denial of service (bsc#1278624).

This update for hauler fixes the following issues:

Changes in hauler:

• update vendor.tar to fix:

  • bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library

• update vendor.tar to fix:

  • bsc#1279416, CVE-2026-84304
  • bsc#1279296, CVE-2026-84303
  • bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers

Update to 2.1.0 (bsc#1265425, CVE-2026-41888).

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library
  • Add update-go-crypto.patch to update affected dependency (bsc#1278586).
• Update to go 1.26 as required to update go crypto library

This update for gh fixes the following issues:

Changes in gh:

Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH channel messages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):

• Fix gh api telemetry disablement
• Bump go-gh to v2.16.0
• Expose per-host API host config
• chore: bump toolchain to go1.26.8
• chore: bump golang.org/x/crypto to 0.56.0
• Record attachment invocation telemetry
• Add webhook as an official extension
• Merge pull request #14318 from cli/issue-triage-improvements
• Refine GHES support wording
• Use version-neutral GHES support link
• Clarify supported GHES versions
• Bump go-gh to v2.15.0
• Remove redundant searcher comment
• Remove unnecessary 204 on release edit
• Remove redundant comment in gist create
• Comment api command api_host usage
• Comment missing api-client-rollout todo
• Document when telemetry disabling is overzealous
• Refactor AddAuthTokenHeader
• Rename tokenGetter to config
• build(deps): bump go-gh to rebased per-host api_host branch
• refactor(attachments): send uploads through api.Client.DoRequest
• test(internal/attachments): add new method required by interface
• fix(api): compare request hostname without port when attaching auth token
• test(acceptance): fix scriptfilter table field alignment
• build(deps): bump go-gh to per-host api_host branch
• chore(codeql): cover api.Client.Request in SafeURL path query
• fix(auth/shared): route GetScopes path through safeurl
• test(config): add coverage for APIHostForHost
• test(config): cover deterministic api_host collision resolution
• test(api): assert DoRequest preserves an explicit ContentLength
• test(acceptance): cover selecting multiple scripts in one directory
• refactor(api): use errors.AsType for HTTP error checks
• fix(config): resolve api_host collisions deterministically
• docs(api): clarify redirect method-rewriting in comments
• Send release asset uploads and downloads through api.Client
• Let callers set headers on a shared client request
• Let a caller stop a request following redirects
• Let a caller name the scopes an endpoint needs
• Add a raw response request surface to api.Client
• Send RenameRepo to a relative path
• Make gh api honour api_host for relative paths
• Send a host's token to its configured api_host
• Add the api_host gateway harness
• Let GH_ACCEPTANCE_SCRIPT name several scripts
• Wait longer for the search index in the issues script
• Add acceptance coverage for gist
• Fix discussion acceptance test flags
• Resolve aliases to their target when rendering full help on error
• Print full help on command misuse for invoking agents

Update to version 2.99.0:

• Add repeatable --attach flag to upload local images/videos to issues, pull requests, and comments (max 50 files per call)
• Add worktree checkout support to gh issue develop --checkout --worktree
• Fix repo sync to avoid corrupting a linked worktree and to explain when the target branch is checked out elsewhere
• Fix pr merge --delete-branch to safely handle linked worktrees
• Reject --comments combined with --json on view commands

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276722).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

• Update to version 20260911.00

• Add support for all possible SCALIBR os extractor for linux (#1052)
• Migrate presubmits from deb11 to deb12 (#1050)
• Bump the go_modules group across 1 directory with 3 updates (#1047)
• Introduce E2E v2 framework and inventory tests (#1039)
• Remove test case for asserting JSON marshal error from task_state.go (#1045)
• security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)
• Add Configuration for SCALIBR (#1034)
• add CheckState and Cleanup tests (#1008)
• Improve unit tests for osinfo/osinfo_linux.go (#1020)
• Bump github.com/go-git/go-git/v5 (#1036)
• Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)
• Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)
• authenticate cloud build to use docker registry (#1030)
• Migrate e2e build to internal image (#1024)
• Upgrade google.golang.org/grpc to new version. (#1023)
• Improve unit tests for ospatch/yum_update.go (#1012)
• Improve unit tests for ospatch/updates.go (#1011)
• Add unit tests for config/package_resource.go PART 2 (#1005)
• Add unit tests for config/package_resource.go PART 1 (#1003)
• Add unit tests for policies/local.go (#1015)
• Add unit tests for repository_resource.go (#1002)
• Add unit tests for installrecipe.go part 2 (#993)
• Add unit tests for scalibr.go (#1019)
• Add unit tests for installrecipe.go part 1 (#992)
• Add test cases for policies/recipes/recipedb.go (#989)
• Bump golang.org/x/crypto (#1021)
• Add unit tests for policies/recipes/steps.go PART 3 (#976)
• Add unit tests for policies/recipes/steps.go PART 2 (#975)
• Bump golang.org/x/net (#1017)
• upgrade x/net package. (#1018)
• Add test cases for config/file_resource.go (#988)
• Add unit tests for policies/recipes/artifacts.go (#985)
• Add unit tests for policies/recipes/steps.go PART 1 (#974)
• Add tests & bugfix for packages/trace.go (#939)
• Add unit tests for agentendpoint/agentendpoint_beta.go (#983)
• Replace yum install with yum update (#1009)
• Bump github.com/containerd/containerd (#1013)
• Add unit tests for policies/apt.go PART 2 (#957)
• Add test cases for agentendpoint/task_state.go (#984)
• Remove deprecated rhel-sap images and add new ones (#1007)
• Add test cases for clog/clog.go (#986)

This update for amazon-ssm-agent fixes the following issues:

• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278681).
• CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).
• CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage (bsc#1276994).

Changes for amazon-ssm-agent:

• Update to version 3.3.5390.0

• Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3
• Bump golang.org/x/crypto from v0.53.0 to v0.56.0
• Bump golang.org/x/net from v0.56.0 to v0.57.0
• Bump golang.org/x/sys from v0.46.0 to v0.47.0
• Upgrade GoLang version from 1.25 to 1.26
• Mint control-channel token after dial to fix AZ-fault token expiry
• Resume patch documents interrupted by an external shutdown
• Use systemctl for systemd in aws: configureDocker on Amazon Linux
• Update greengrass component version to 1.3.5

• Update to version 3.3.5226.0

• Add bounds check for HeaderLength in AgentMessage Deserialize
• Bump github.com/go-git/go-git/v5 to v5.19.2
• Bump golang.org/x/sync to v0.21.0
• Detect Azure Linux and potential future unregistered Linux platforms
• Fix Windows session command parsing by removing shlex
• Fix shell injection in Windows domainjoin plugin parameters
• Prevent control channel deadlock on ProcessorBufferFull
• Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
• Update the logic for loading RegistrationInfo
• Upgrade Go version to 1.25.13

• Update to version 3.3.5068.0

• Migrate from aws-sdk-go v1 to aws-sdk-go-v2
• Fix flaky registration/connection channel tests
• Sync AWS SDK fork in extra/ with multicloud vendor changes
• Harden function create file with permissions in a single syscall
• Upgrade Go version to 1.25.12
• Bump golang.org/x/[email protected] to golang.org/x/[email protected]
• Fix loopback bypass in remote-host port forwarding denylist

• Update to version 3.3.4851.0

• Add ECS/EKS credential endpoints and loopback to port-forward denylist
• Canonicalize IP addresses before port-forwarding denylist check
• Pass the ActiveDirectory domain password via stdin using -y /dev/stdin instead of the -w flag
• Fix false StuckAtInProgress timeout for associations with rate >= 2h
• Fix non-interactive session big file transfer issues
• Prevent ssm-user race condition with flock-based serialization
• Send AWS::EC2::Instance as source type when registered with provider EC2
• Validate process name in orphan worker detection

• Update to version 3.3.4793.0

• Add multicloud support enabling SSM Agent registration with Azure cloud providers
• Add support for the upcoming public key in the agent code

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.9.1
  • Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)
  • Propagate edge registration errors over QUIC and fix supervisor error classification
  • Negotiate protected mode during Quick Tunnel provisioning

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)
• Fix
  • a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),
  • a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236),
  • a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.75.1: (boo#1279548)
  • Security
    • archive
      • Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)
      • Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    • build
      • Fix multiple CVEs by upgrading to go1.26.6 (Nick Craig-Wood)
        • CVE-2026-56860: net/url: quadratic complexity in resolvePath
        • CVE-2026-56858: html/template: JavaScript regexp context tracking
        • CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
        • CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
        • CVE-2026-56859: encoding/xml: recursion depth guard during decode
        • CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
        • CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
        • CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
      • Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs (Nick Craig-Wood)
        • CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
        • CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
        • CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
      • Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603 (Nick Craig-Wood)
        • CVE-2026-46603: excessive memory allocation during VP8L decoding
      • fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick Craig-Wood)
      • fshttp: Don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
      • http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
      • lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
      • local
        • Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
        • Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
        • Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)
      • serve docker
        • Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
        • Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
        • Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
      • serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)
      • serve s3
        • Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)
        • Reject bogus multipart part sizes in the reorder…

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for cosign fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).
• Verification bypass via public key in legacy bundle (bsc#1282542).

Changes for cosign:

• update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):

• This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.
• Auto-detect default digest algorithm for public keys
• fix(pkcs11key): return an error instead of panicking when no key pair matches
• Supporting OCI Signing with X.509 Certificate Chain
• test(inspect): replace mock TSA client usage with local timestamp response generator in
• fix: prevent shell completions for various options not taking filenames
• fix(blob): compare file checksums case-insensitively in
• Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98)

Root has patched CVE-2026-56854 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
• GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
• GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
• GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
• GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
• GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
• GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
• GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
• GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
• GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
• GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
• GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
• GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
• GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
• GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
• GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
• GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
• GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
• GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
• GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
• GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
• GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
• GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
• GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
• GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
• GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
• GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
• GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
• GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
• GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
• GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
• GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
• GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
• GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
• GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
• GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
• GO-2026-6354 CVE-2026-78662
• GO-2026-6355 CVE-2026-56855

• Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.

• GO-2026-6303 CVE-2026-56854

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
• GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
• GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
• GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
• GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
• GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
• GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
• GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
• GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
• GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
• GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
• GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
• GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
• GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
• GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
• GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
• GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
• GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
• GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
• GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
• GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
• GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
• GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
• GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
• GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
• GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
• GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
• GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
• GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
• GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
• GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
• GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
• GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
• GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
• GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
• GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
• GO-2026-6354 CVE-2026-78662
• GO-2026-6355 CVE-2026-56855

• Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.

• GO-2026-6303 CVE-2026-56854

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

• Update to version 20260908.00

This update for google-guest-agent fixes the following issues:

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)

This update for google-osconfig-agent fixes the following issue:

• CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).

This update for google-guest-agent fixes the following issues:

• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276722).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).

Changes for google-osconfig-agent:

• Update to version 20260911.00

• Add support for all possible SCALIBR os extractor for linux (#1052)

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276722).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).

Changes for google-osconfig-agent:

• Update to version 20260911.00

• Add support for all possible SCALIBR os extractor for linux (#1052)

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for cosign fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).
• Verification bypass via public key in legacy bundle (bsc#1282542).

Changes for cosign:

• update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):

• This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.
• Auto-detect default digest algorithm for public keys
• fix(pkcs11key): return an error instead of panicking when no key pair matches
• Supporting OCI Signing with X.509 Certificate Chain
• test(inspect): replace mock TSA client usage with local timestamp response generator in
• fix: prevent shell completions for various options not taking filenames
• fix(blob): compare file checksums case-insensitively in
• Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98)

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
• CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

• update to 4.3.0:

• feat: Add duration functions
• feat(engine): add debug logging when lookup returns empty
• feat: add ownership verification before deleting resources
• feat: honor SOURCE_DATE_EPOCH for chart archives
• feat(rollback): add --description flag to provide rollback reason
• fix (internal/plugin): remove zero-width spaces from plugin name comment
• fix(loader): do not drop values files ending at a 4096-byte boundary
• fix(chart): normalize StampModTimes timestamp to UTC/truncate

• Chart.lock reproducibility test

• fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
• fix(template): regression - route registry messages to stderr in template and show
• refactor: lower resync period from one hour to 3 minutes
• perf: enable concurrent status computation to prevent multi-minute delays
• fix: Improve error reporting for helm template --debug with --show-only- #31185
• fix: fetch logs from all containers in test pods- #32099
• fix(provenance): check error return in Digest and encodeRelease- #32136
• fix panic on repeated IsReachable calls- #32184
• fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211
• Fix missing conflict retry with server-side apply- #32088
• Properly format the extra field in gzipped…