CVE-2026-56855

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

• buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

• buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

• buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

• buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

• golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)

• net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

• crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
• buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
• buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
• buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
• buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
• golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)
• net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
• crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

These are all security issues fixed in the hauler-2.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.74.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gh-2.100.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kbfs-6.6.3-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-7.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gitea-tea-0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm-4.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the zk-0.15.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

• CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates (bsc#1258543).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278624).
• CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279390).
• CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1279392).

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
• GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
• GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
• GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
• GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
• GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
• GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
• GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
• GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
• GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
• GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
• GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
• GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
• GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
• GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
• GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
• GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
• GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
• GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
• GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
• GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
• GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
• GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
• GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
• GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
• GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
• GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
• GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
• GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
• GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
• GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
• GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
• GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
• GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
• GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
• GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
• GO-2026-6354 CVE-2026-78662
• GO-2026-6355 CVE-2026-56855

• Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.

• GO-2026-6303 CVE-2026-56854

This update for zk fixes the following issues:

Changes in zk:

• Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447):
  • Upgrade golang.org/x/crypto to v0.56.0 to fix security vulnerabilities in the embedded x/crypto/ssh package:
    • CVE-2026-56854: authentication bypass
    • CVE-2026-56855: deadlock vulnerability
    • CVE-2026-78662: deadlock vulnerability

This update for hauler fixes the following issues:

Changes in hauler:

Update to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).

This update for containerized-data-importer1.65 fixes the following issues:

• CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
• CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
• CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
• CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
• CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
• CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).

This update for trivy fixes the following issues:

• CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).
• CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).
• CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and denial of service (bsc#1278624).
• CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection deadlocks and denial of service (bsc#1278624).

This update for hauler fixes the following issues:

Changes in hauler:

• update vendor.tar to fix:

  • bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library

• update vendor.tar to fix:

  • bsc#1279416, CVE-2026-84304
  • bsc#1279296, CVE-2026-84303
  • bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers

Update to 2.1.0 (bsc#1265425, CVE-2026-41888).

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library
  • Add update-go-crypto.patch to update affected dependency (bsc#1278586).
• Update to go 1.26 as required to update go crypto library

This update for gh fixes the following issues:

Changes in gh:

Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH channel messages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):

• Fix gh api telemetry disablement
• Bump go-gh to v2.16.0
• Expose per-host API host config
• chore: bump toolchain to go1.26.8
• chore: bump golang.org/x/crypto to 0.56.0
• Record attachment invocation telemetry
• Add webhook as an official extension
• Merge pull request #14318 from cli/issue-triage-improvements
• Refine GHES support wording
• Use version-neutral GHES support link
• Clarify supported GHES versions
• Bump go-gh to v2.15.0
• Remove redundant searcher comment
• Remove unnecessary 204 on release edit
• Remove redundant comment in gist create
• Comment api command api_host usage
• Comment missing api-client-rollout todo
• Document when telemetry disabling is overzealous
• Refactor AddAuthTokenHeader
• Rename tokenGetter to config
• build(deps): bump go-gh to rebased per-host api_host branch
• refactor(attachments): send uploads through api.Client.DoRequest
• test(internal/attachments): add new method required by interface
• fix(api): compare request hostname without port when attaching auth token
• test(acceptance): fix scriptfilter table field alignment
• build(deps): bump go-gh to per-host api_host branch
• chore(codeql): cover api.Client.Request in SafeURL path query
• fix(auth/shared): route GetScopes path through safeurl
• test(config): add coverage for APIHostForHost
• test(config): cover deterministic api_host collision resolution
• test(api): assert DoRequest preserves an explicit ContentLength
• test(acceptance): cover selecting multiple scripts in one directory
• refactor(api): use errors.AsType for HTTP error checks
• fix(config): resolve api_host collisions deterministically
• docs(api): clarify redirect method-rewriting in comments
• Send release asset uploads and downloads through api.Client
• Let callers set headers on a shared client request
• Let a caller stop a request following redirects
• Let a caller name the scopes an endpoint needs
• Add a raw response request surface to api.Client
• Send RenameRepo to a relative path
• Make gh api honour api_host for relative paths
• Send a host's token to its configured api_host
• Add the api_host gateway harness
• Let GH_ACCEPTANCE_SCRIPT name several scripts
• Wait longer for the search index in the issues script
• Add acceptance coverage for gist
• Fix discussion acceptance test flags
• Resolve aliases to their target when rendering full help on error
• Print full help on command misuse for invoking agents

Update to version 2.99.0:

• Add repeatable --attach flag to upload local images/videos to issues, pull requests, and comments (max 50 files per call)
• Add worktree checkout support to gh issue develop --checkout --worktree
• Fix repo sync to avoid corrupting a linked worktree and to explain when the target branch is checked out elsewhere
• Fix pr merge --delete-branch to safely handle linked worktrees
• Reject --comments combined with --json on view commands

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)

This update for google-osconfig-agent fixes the following issues:

• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276722).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

• Update to version 20260911.00

• Add support for all possible SCALIBR os extractor for linux (#1052)
• Migrate presubmits from deb11 to deb12 (#1050)
• Bump the go_modules group across 1 directory with 3 updates (#1047)
• Introduce E2E v2 framework and inventory tests (#1039)
• Remove test case for asserting JSON marshal error from task_state.go (#1045)
• security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)
• Add Configuration for SCALIBR (#1034)
• add CheckState and Cleanup tests (#1008)
• Improve unit tests for osinfo/osinfo_linux.go (#1020)
• Bump github.com/go-git/go-git/v5 (#1036)
• Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)
• Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)
• authenticate cloud build to use docker registry (#1030)
• Migrate e2e build to internal image (#1024)
• Upgrade google.golang.org/grpc to new version. (#1023)
• Improve unit tests for ospatch/yum_update.go (#1012)
• Improve unit tests for ospatch/updates.go (#1011)
• Add unit tests for config/package_resource.go PART 2 (#1005)
• Add unit tests for config/package_resource.go PART 1 (#1003)
• Add unit tests for policies/local.go (#1015)
• Add unit tests for repository_resource.go (#1002)
• Add unit tests for installrecipe.go part 2 (#993)
• Add unit tests for scalibr.go (#1019)
• Add unit tests for installrecipe.go part 1 (#992)
• Add test cases for policies/recipes/recipedb.go (#989)
• Bump golang.org/x/crypto (#1021)
• Add unit tests for policies/recipes/steps.go PART 3 (#976)
• Add unit tests for policies/recipes/steps.go PART 2 (#975)
• Bump golang.org/x/net (#1017)
• upgrade x/net package. (#1018)
• Add test cases for config/file_resource.go (#988)
• Add unit tests for policies/recipes/artifacts.go (#985)
• Add unit tests for policies/recipes/steps.go PART 1 (#974)
• Add tests & bugfix for packages/trace.go (#939)
• Add unit tests for agentendpoint/agentendpoint_beta.go (#983)
• Replace yum install with yum update (#1009)
• Bump github.com/containerd/containerd (#1013)
• Add unit tests for policies/apt.go PART 2 (#957)
• Add test cases for agentendpoint/task_state.go (#984)
• Remove deprecated rhel-sap images and add new ones (#1007)
• Add test cases for clog/clog.go (#986)