Every CVE Search/ Get API key

CVE-2026-78662

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

7.5 HighFix available

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.43%Up 0.3 points since Sep 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
CVE-2026-78662
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-70266 7.5

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
EUVD-2026-70266
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
NVD 7.5

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
CVE-2026-78662
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-770
Updated
2026-11-02
OSV 7.5

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
CVE-2026-78662
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2026-78662 7.5

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
DEBIAN-CVE-2026-78662
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78662 7.5

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
UBUNTU-CVE-2026-78662
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 47 moreShow less
OSVAZL-111617 No score

CVE-2026-78662 affecting package kubevirt-openvmm 1.9.0-1

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-111617
Updated
2026-11-05
OSVAZL-99126 No score

CVE-2026-78662 affecting package buildah 1.43.1-3

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99126
Updated
2026-11-05
OSVAZL-99129 No score

CVE-2026-78662 affecting package cri-o 1.30.1-1

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99129
Updated
2026-11-05
OSVAZL-99144 No score

CVE-2026-78662 affecting package podman 5.6.1-10

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99144
Updated
2026-11-05
OSVAZL-99156 No score

CVE-2026-78662 affecting package cert-manager for versions less than 1.12.15-14

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99156
Updated
2026-11-05
OSVAZL-99165 No score

CVE-2026-78662 affecting package cf-cli for versions less than 8.7.11-9

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99165
Updated
2026-11-05
OSVAZL-99195 No score

CVE-2026-78662 affecting package docker-buildx for versions less than 0.14.0-17

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99195
Updated
2026-11-05
OSVAZL-99207 No score

CVE-2026-78662 affecting package docker-compose for versions less than 2.27.0-14

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99207
Updated
2026-11-05
OSVAZL-99225 No score

CVE-2026-78662 affecting package gh for versions less than 2.101.0-1

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99225
Updated
2026-11-02
OSVAZL-99249 No score

CVE-2026-78662 affecting package kubernetes for versions less than 1.30.10-30

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99249
Updated
2026-11-05
OSVAZL-99261 No score

CVE-2026-78662 affecting package kubevirt for versions less than 1.8.4-2

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99261
Updated
2026-11-05
OSVAZL-99273 No score

CVE-2026-78662 affecting package libcontainers-common 20240213-3

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99273
Updated
2026-11-02
OSVAZL-99285 No score

CVE-2026-78662 affecting package moby-engine for versions less than 25.0.18-1

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99285
Updated
2026-11-05
OSVAZL-99312 No score

CVE-2026-78662 affecting package nvidia-container-toolkit 1.17.8-4

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99312
Updated
2026-11-02
OSVAZL-99321 No score

CVE-2026-78662 affecting package packer for versions less than 1.9.5-21

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99321
Updated
2026-11-05
OSVAZL-99384 No score

CVE-2026-78662 affecting package telegraf for versions less than 1.31.0-33

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
AZL-99384
Updated
2026-11-05
OSVGO-2026-6354 No score

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Record
GO-2026-6354
Updated
2026-11-02
OSVopenSUSE-SU-2026:11727-1 No score

rclone-1.75.1-1.1 on GA media

These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11727-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12241-1 No score

kubevirt1.8-container-disk-1.8.4-7.1 on GA media

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-7.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12241-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12258-1 No score

zk-0.15.7-1.1 on GA media

These are all security issues fixed in the zk-0.15.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12258-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12260-1 No score

buildpacks-cli-0.40.10-1.1 on GA media

These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12260-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21801-1 No score

Security update for trivy

This update for trivy fixes the following issues:

  • CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates (bsc#1258543).
  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278624).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279390).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1279392).
Record
openSUSE-SU-2026:21801-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21812-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
  • GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
  • GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
  • GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
  • GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
  • GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
  • GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
  • GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
  • GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
  • GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
  • GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
  • GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
  • GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
  • GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
  • GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
  • GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
  • GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
  • GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
  • GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
  • GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
  • GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
  • GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
  • GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
  • GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
  • GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
  • GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
  • GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
  • GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
  • GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
  • GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
  • GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
  • GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
  • GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
  • GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
  • GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
  • GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
  • GO-2026-6354 CVE-2026-78662
  • GO-2026-6355 CVE-2026-56855
  • Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.
  • GO-2026-6303 CVE-2026-56854
Record
openSUSE-SU-2026:21812-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21814-1 No score

Security update for zk

This update for zk fixes the following issues:

Changes in zk:

  • Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447):
    • Upgrade golang.org/x/crypto to v0.56.0 to fix security vulnerabilities in the embedded x/crypto/ssh package:
      • CVE-2026-56854: authentication bypass
      • CVE-2026-56855: deadlock vulnerability
      • CVE-2026-78662: deadlock vulnerability
Record
openSUSE-SU-2026:21814-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21816-1 No score

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

Update to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).

Record
openSUSE-SU-2026:21816-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21824-1 No score

Security update for containerized-data-importer1.65

This update for containerized-data-importer1.65 fixes the following issues:

  • CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
  • CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241838).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251495).
  • CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1253506).
  • CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
  • CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
  • CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251689).
  • CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267176).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260295).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265799).
  • CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262952).
  • CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service (bsc#1262269).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266639).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597, CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276687).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278621).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279315).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).
Record
openSUSE-SU-2026:21824-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21835-1 No score

Security update for trivy

This update for trivy fixes the following issues:

  • CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).
  • CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).
  • CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and denial of service (bsc#1278624).
  • CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection deadlocks and denial of service (bsc#1278624).
Record
openSUSE-SU-2026:21835-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21841-1 No score

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

  • update vendor.tar to fix:

    • bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: hauler: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library

  • update vendor.tar to fix:

    • bsc#1279416, CVE-2026-84304
    • bsc#1279296, CVE-2026-84303
    • bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers

Update to 2.1.0 (bsc#1265425, CVE-2026-41888).

Record
openSUSE-SU-2026:21841-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21846-1 No score

Security update for keybase-client

This update for keybase-client fixes the following issues:

Changes in keybase-client:

  • CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library
    • Add update-go-crypto.patch to update affected dependency (bsc#1278586).
  • Update to go 1.26 as required to update go crypto library
Record
openSUSE-SU-2026:21846-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21861-1 No score

Security update for gh

This update for gh fixes the following issues:

Changes in gh:

Update to version 2.100.0, fixing two deadlock issues in the vendored golang.org/x/crypto/ssh library reachable via crafted SSH channel messages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):

  • Fix gh api telemetry disablement
  • Bump go-gh to v2.16.0
  • Expose per-host API host config
  • chore: bump toolchain to go1.26.8
  • chore: bump golang.org/x/crypto to 0.56.0
  • Record attachment invocation telemetry
  • Add webhook as an official extension
  • Merge pull request #14318 from cli/issue-triage-improvements
  • Refine GHES support wording
  • Use version-neutral GHES support link
  • Clarify supported GHES versions
  • Bump go-gh to v2.15.0
  • Remove redundant searcher comment
  • Remove unnecessary 204 on release edit
  • Remove redundant comment in gist create
  • Comment api command api_host usage
  • Comment missing api-client-rollout todo
  • Document when telemetry disabling is overzealous
  • Refactor AddAuthTokenHeader
  • Rename tokenGetter to config
  • build(deps): bump go-gh to rebased per-host api_host branch
  • refactor(attachments): send uploads through api.Client.DoRequest
  • test(internal/attachments): add new method required by interface
  • fix(api): compare request hostname without port when attaching auth token
  • test(acceptance): fix scriptfilter table field alignment
  • build(deps): bump go-gh to per-host api_host branch
  • chore(codeql): cover api.Client.Request in SafeURL path query
  • fix(auth/shared): route GetScopes path through safeurl
  • test(config): add coverage for APIHostForHost
  • test(config): cover deterministic api_host collision resolution
  • test(api): assert DoRequest preserves an explicit ContentLength
  • test(acceptance): cover selecting multiple scripts in one directory
  • refactor(api): use errors.AsType for HTTP error checks
  • fix(config): resolve api_host collisions deterministically
  • docs(api): clarify redirect method-rewriting in comments
  • Send release asset uploads and downloads through api.Client
  • Let callers set headers on a shared client request
  • Let a caller stop a request following redirects
  • Let a caller name the scopes an endpoint needs
  • Add a raw response request surface to api.Client
  • Send RenameRepo to a relative path
  • Make gh api honour api_host for relative paths
  • Send a host's token to its configured api_host
  • Add the api_host gateway harness
  • Let GH_ACCEPTANCE_SCRIPT name several scripts
  • Wait longer for the search index in the issues script
  • Add acceptance coverage for gist
  • Fix discussion acceptance test flags
  • Resolve aliases to their target when rendering full help on error
  • Print full help on command misuse for invoking agents

Update to version 2.99.0:

  • Add repeatable --attach flag to upload local images/videos to issues, pull requests, and comments (max 50 files per call)
  • Add worktree checkout support to gh issue develop --checkout --worktree
  • Fix repo sync to avoid corrupting a linked worktree and to explain when the target branch is checked out elsewhere
  • Fix pr merge --delete-branch to safely handle linked worktrees
  • Reject --comments combined with --json on view commands
Record
openSUSE-SU-2026:21861-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21879-1 No score

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues:

  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

  • Update to version 20260903.01
  • Update dependencies to latest (#636)
  • fix octal digit comparison in morePermissive (#631)
  • Remove KillMode from google-guest-agent-manager (#629)
  • Fix SUSE Linux Micro 6+ (#628)
  • Fix oslogin for Micro 6+
  • Exclude irrelevant tests on FreeBSD (#625)
  • Replace abandoned serial dependency (#624)
  • Add build rules for MWLID extension
  • Support basic account management on FreeBSD (#619)
  • fix dependency between sshd and google-guest-agent-manager.service (#621)
  • Update go.mod dependencies (#622)
  • Fallback to shebang execution when running scripts (#618)
  • Update go dependencies (#620)
  • Make guest-agent buildable on FreeBSD (#617)
Record
openSUSE-SU-2026:21879-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21882-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276722).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

  • Update to version 20260911.00
  • Add support for all possible SCALIBR os extractor for linux (#1052)
  • Migrate presubmits from deb11 to deb12 (#1050)
  • Bump the go_modules group across 1 directory with 3 updates (#1047)
  • Introduce E2E v2 framework and inventory tests (#1039)
  • Remove test case for asserting JSON marshal error from task_state.go (#1045)
  • security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)
  • Add Configuration for SCALIBR (#1034)
  • add CheckState and Cleanup tests (#1008)
  • Improve unit tests for osinfo/osinfo_linux.go (#1020)
  • Bump github.com/go-git/go-git/v5 (#1036)
  • Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)
  • Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)
  • authenticate cloud build to use docker registry (#1030)
  • Migrate e2e build to internal image (#1024)
  • Upgrade google.golang.org/grpc to new version. (#1023)
  • Improve unit tests for ospatch/yum_update.go (#1012)
  • Improve unit tests for ospatch/updates.go (#1011)
  • Add unit tests for config/package_resource.go PART 2 (#1005)
  • Add unit tests for config/package_resource.go PART 1 (#1003)
  • Add unit tests for policies/local.go (#1015)
  • Add unit tests for repository_resource.go (#1002)
  • Add unit tests for installrecipe.go part 2 (#993)
  • Add unit tests for scalibr.go (#1019)
  • Add unit tests for installrecipe.go part 1 (#992)
  • Add test cases for policies/recipes/recipedb.go (#989)
  • Bump golang.org/x/crypto (#1021)
  • Add unit tests for policies/recipes/steps.go PART 3 (#976)
  • Add unit tests for policies/recipes/steps.go PART 2 (#975)
  • Bump golang.org/x/net (#1017)
  • upgrade x/net package. (#1018)
  • Add test cases for config/file_resource.go (#988)
  • Add unit tests for policies/recipes/artifacts.go (#985)
  • Add unit tests for policies/recipes/steps.go PART 1 (#974)
  • Add tests & bugfix for packages/trace.go (#939)
  • Add unit tests for agentendpoint/agentendpoint_beta.go (#983)
  • Replace yum install with yum update (#1009)
  • Bump github.com/containerd/containerd (#1013)
  • Add unit tests for policies/apt.go PART 2 (#957)
  • Add test cases for agentendpoint/task_state.go (#984)
  • Remove deprecated rhel-sap images and add new ones (#1007)
  • Add test cases for clog/clog.go (#986)
Record
openSUSE-SU-2026:21882-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21884-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues:

  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278681).
  • CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).
  • CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage (bsc#1276994).

Changes for amazon-ssm-agent:

  • Update to version 3.3.5390.0
  • Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3
  • Bump golang.org/x/crypto from v0.53.0 to v0.56.0
  • Bump golang.org/x/net from v0.56.0 to v0.57.0
  • Bump golang.org/x/sys from v0.46.0 to v0.47.0
  • Upgrade GoLang version from 1.25 to 1.26
  • Mint control-channel token after dial to fix AZ-fault token expiry
  • Resume patch documents interrupted by an external shutdown
  • Use systemctl for systemd in aws: configureDocker on Amazon Linux
  • Update greengrass component version to 1.3.5
  • Update to version 3.3.5226.0
  • Add bounds check for HeaderLength in AgentMessage Deserialize
  • Bump github.com/go-git/go-git/v5 to v5.19.2
  • Bump golang.org/x/sync to v0.21.0
  • Detect Azure Linux and potential future unregistered Linux platforms
  • Fix Windows session command parsing by removing shlex
  • Fix shell injection in Windows domainjoin plugin parameters
  • Prevent control channel deadlock on ProcessorBufferFull
  • Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
  • Update the logic for loading RegistrationInfo
  • Upgrade Go version to 1.25.13
  • Update to version 3.3.5068.0
  • Migrate from aws-sdk-go v1 to aws-sdk-go-v2
  • Fix flaky registration/connection channel tests
  • Sync AWS SDK fork in extra/ with multicloud vendor changes
  • Harden function create file with permissions in a single syscall
  • Upgrade Go version to 1.25.12
  • Bump golang.org/x/[email protected] to golang.org/x/[email protected]
  • Fix loopback bypass in remote-host port forwarding denylist
  • Update to version 3.3.4851.0
  • Add ECS/EKS credential endpoints and loopback to port-forward denylist
  • Canonicalize IP addresses before port-forwarding denylist check
  • Pass the ActiveDirectory domain password via stdin using -y /dev/stdin instead of the -w flag
  • Fix false StuckAtInProgress timeout for associations with rate >= 2h
  • Fix non-interactive session big file transfer issues
  • Prevent ssm-user race condition with flock-based serialization
  • Send AWS::EC2::Instance as source type when registered with provider EC2
  • Validate process name in orphan worker detection
  • Update to version 3.3.4793.0
  • Add multicloud support enabling SSM Agent registration with Azure cloud providers
  • Add support for the upcoming public key in the agent code
Record
openSUSE-SU-2026:21884-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21924-1 No score

Security update for cloudflared

This update for cloudflared fixes the following issues:

Changes in cloudflared:

  • Update version to 2026.9.1
    • Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)
    • Propagate edge registration errors over QUIC and fix supervisor error classification
    • Negotiate protected mode during Quick Tunnel provisioning
Record
openSUSE-SU-2026:21924-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21927-1 No score

Security update for apptainer

This update for apptainer fixes the following issues:

Changes in apptainer:

  • Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)
  • Fix
    • a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),
    • a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236),
    • a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2
Record
openSUSE-SU-2026:21927-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21983-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21983-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21999-1 No score

Security update for rclone

This update for rclone fixes the following issues:

Changes in rclone:

  • Update to version 1.75.1: (boo#1279548)
    • Security
      • archive
        • Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)
        • Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
        • Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
        • Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
        • Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
        • Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • build
        • Fix multiple CVEs by upgrading to go1.26.6 (Nick Craig-Wood)
          • CVE-2026-56860: net/url: quadratic complexity in resolvePath
          • CVE-2026-56858: html/template: JavaScript regexp context tracking
          • CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
          • CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
          • CVE-2026-56859: encoding/xml: recursion depth guard during decode
          • CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
          • CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
          • CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
        • Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs (Nick Craig-Wood)
          • CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
          • CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
          • CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
        • Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603 (Nick Craig-Wood)
          • CVE-2026-46603: excessive memory allocation during VP8L decoding
        • fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick Craig-Wood)
        • fshttp: Don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
        • http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
        • lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
        • local
          • Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
          • Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
          • Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)
        • serve docker
          • Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
          • Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
          • Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
        • serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)
        • serve s3
          • Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)
          • Reject bogus multipart part sizes in the reorder…
Record
openSUSE-SU-2026:21999-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22032-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
  • CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
  • CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
  • CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
  • CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
  • CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
  • CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
  • CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
  • CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
  • CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
  • CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
  • CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
  • CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

  • Remove withdrawn lib/pq CVEs from govulncheck
  • Add backticks to component name in generated doc output
  • BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
  • prometheus.enrich: Support multi-label matching
  • prometheus.relabel: Add opt-in TTL cache mode
  • telemetry: Add new metrics for graph connections and pyroscope forwarded entries
  • database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
  • Add nop receiver to OTel Engine
  • Backport dependency upgrades to address GO-2026-6061
Record
openSUSE-SU-2026:22032-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22064-1 No score

Security update for cosign

This update for cosign fixes the following issues:

  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).
  • Verification bypass via public key in legacy bundle (bsc#1282542).

Changes for cosign:

  • update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):
  • This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.
  • Auto-detect default digest algorithm for public keys
  • fix(pkcs11key): return an error instead of panicking when no key pair matches
  • Supporting OCI Signing with X.509 Certificate Chain
  • test(inspect): replace mock TSA client usage with local timestamp response generator in
  • fix: prevent shell completions for various options not taking filenames
  • fix(blob): compare file checksums case-insensitively in
  • Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98)
Record
openSUSE-SU-2026:22064-1
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-78662 No score

CVE-2026-78662 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-78662 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-78662
Updated
2026-11-05
OSVSUSE-SU-2026:23692-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
  • GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
  • GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
  • GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
  • GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
  • GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
  • GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
  • GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
  • GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
  • GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
  • GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
  • GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
  • GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
  • GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
  • GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
  • GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
  • GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
  • GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
  • GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
  • GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
  • GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
  • GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
  • GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
  • GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
  • GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
  • GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
  • GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
  • GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
  • GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
  • GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
  • GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
  • GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
  • GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
  • GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
  • GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
  • GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
  • GO-2026-6354 CVE-2026-78662
  • GO-2026-6355 CVE-2026-56855
  • Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.
  • GO-2026-6303 CVE-2026-56854
Record
SUSE-SU-2026:23692-1
Updated
2026-11-02
OSVSUSE-SU-2026:23712-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv
  • GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4
  • GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g
  • GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg
  • GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg
  • GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v
  • GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4
  • GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x
  • GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv
  • GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp
  • GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8
  • GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp
  • GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx
  • GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f
  • GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg
  • GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc
  • GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj
  • GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw
  • GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv
  • GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc
  • GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2
  • GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv
  • GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4
  • GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c
  • GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c
  • GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x
  • GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh
  • GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx
  • GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r
  • GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3
  • GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899
  • GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f
  • GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf
  • GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8
  • GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f
  • GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v
  • GO-2026-6354 CVE-2026-78662
  • GO-2026-6355 CVE-2026-56855
  • Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.
  • GO-2026-6303 CVE-2026-56854
Record
SUSE-SU-2026:23712-1
Updated
2026-11-02
OSVSUSE-SU-2026:23736-1 No score

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues:

  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

  • Update to version 20260903.01
  • Update dependencies to latest (#636)
  • fix octal digit comparison in morePermissive (#631)
  • Remove KillMode from google-guest-agent-manager (#629)
  • Fix SUSE Linux Micro 6+ (#628)
  • Fix oslogin for Micro 6+
  • Exclude irrelevant tests on FreeBSD (#625)
  • Replace abandoned serial dependency (#624)
  • Add build rules for MWLID extension
  • Support basic account management on FreeBSD (#619)
  • fix dependency between sshd and google-guest-agent-manager.service (#621)
  • Update go.mod dependencies (#622)
  • Fallback to shebang execution when running scripts (#618)
  • Update go dependencies (#620)
  • Make guest-agent buildable on FreeBSD (#617)
Record
SUSE-SU-2026:23736-1
Updated
2026-11-02
OSVSUSE-SU-2026:23739-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
  • CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-osconfig-agent:

  • Update to version 20260908.00
Record
SUSE-SU-2026:23739-1
Updated
2026-11-02
OSVSUSE-SU-2026:23745-1 No score

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
Record
SUSE-SU-2026:23745-1
Updated
2026-11-02
OSVSUSE-SU-2026:23831-1 No score

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues:

  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

  • Update to version 20260903.01
  • Update dependencies to latest (#636)
  • fix octal digit comparison in morePermissive (#631)
  • Remove KillMode from google-guest-agent-manager (#629)
  • Fix SUSE Linux Micro 6+ (#628)
  • Fix oslogin for Micro 6+
  • Exclude irrelevant tests on FreeBSD (#625)
  • Replace abandoned serial dependency (#624)
  • Add build rules for MWLID extension
  • Support basic account management on FreeBSD (#619)
  • fix dependency between sshd and google-guest-agent-manager.service (#621)
  • Update go.mod dependencies (#622)
  • Fallback to shebang execution when running scripts (#618)
  • Update go dependencies (#620)
  • Make guest-agent buildable on FreeBSD (#617)
Record
SUSE-SU-2026:23831-1
Updated
2026-11-02
OSVSUSE-SU-2026:23841-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue:

  • CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
  • CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
Record
SUSE-SU-2026:23841-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
buildah
Azure Linux:3
 through 1.43.1-3 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
cert-manager
Azure Linux:3
 before 1.12.15-14
1.12.15-14
cf-cli
Azure Linux:3
 before 8.7.11-9
8.7.11-9
docker-buildx
Azure Linux:3
 before 0.14.0-17
0.14.0-17
docker-compose
Azure Linux:3
 before 2.27.0-14
2.27.0-14
gh
Azure Linux:3
 before 2.101.0-1
2.101.0-1
kubernetes
Azure Linux:3
 before 1.30.10-30
1.30.10-30
Show 132 moreShow less
Affected packages
PackageAffectedFixed
kubevirt
Azure Linux:3
 before 1.8.4-2
1.8.4-2
libcontainers-common
Azure Linux:3
 through 20240213-3 None known
moby-engine
Azure Linux:3
 before 25.0.18-1
25.0.18-1
nvidia-container-toolkit
Azure Linux:3
 through 1.17.8-4 None known
packer
Azure Linux:3
 before 1.9.5-21
1.9.5-21
telegraf
Azure Linux:3
 before 1.31.0-33
1.31.0-33
golang-go.crypto
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.12.0-11:0.13.0-11:0.14.0-11:0.16.0-1
Show 31 moreShow less
1:0.17.0-11:0.18.0-11:0.19.0-11:0.21.0-11:0.22.0-11:0.23.0-11:0.24.0-11:0.24.0-21:0.25.0-11:0.25.0-1~bpo12+11:0.33.0-1~exp11:0.36.0-1~exp11:0.4.0-11:0.41.0-1~exp11:0.42.0-11:0.42.0-1~exp11:0.42.0-21:0.42.0-31:0.42.0-41:0.43.0-11:0.43.0-21:0.45.0-11:0.46.0-11:0.47.0-11:0.50.0-11:0.52.0-11:0.52.0-1~bpo13+11:0.53.0-11:0.54.0-11:0.55.0-11:0.56.0-1
 None known
golang-go.crypto
Debian:13
 All versions, plus listed versions
1:0.25.0-11:0.33.0-1~exp11:0.36.0-1~exp11:0.41.0-1~exp11:0.42.0-1
Show 16 moreShow less
1:0.42.0-1~exp11:0.42.0-21:0.42.0-31:0.42.0-41:0.43.0-11:0.43.0-21:0.45.0-11:0.46.0-11:0.47.0-11:0.50.0-11:0.52.0-11:0.52.0-1~bpo13+11:0.53.0-11:0.54.0-11:0.55.0-11:0.56.0-1
 None known
golang-go.crypto
Debian:14
 before 1:0.56.0-1, plus listed versions
1:0.25.0-11:0.33.0-1~exp11:0.36.0-1~exp11:0.41.0-1~exp11:0.42.0-1
Show 15 moreShow less
1:0.42.0-1~exp11:0.42.0-21:0.42.0-31:0.42.0-41:0.43.0-11:0.43.0-21:0.45.0-11:0.46.0-11:0.47.0-11:0.50.0-11:0.52.0-11:0.52.0-1~bpo13+11:0.53.0-11:0.54.0-11:0.55.0-1
1:0.56.0-1
golang.org/x/crypto
Go
 before 0.56.0
0.56.0
golang.org/x/crypto
Root:Go
 before v0.48.0-aikido.2
v0.48.0-aikido.2v0.55.0-aikido.1v0.37.0-aikido.6v0.54.0-aikido.2v0.52.0-aikido.3v0.54.0-aikido.3v0.40.0-aikido.8v0.40.0-aikido.9v0.53.0-aikido.2v0.53.0-aikido.3v0.32.0-aikido.6v0.47.0-aikido.1v0.47.0-aikido.2v0.49.0-aikido.4v0.36.0-aikido.3v0.31.0-aikido.12v0.31.0-aikido.10v0.31.0-aikido.11v0.46.0-aikido.3v0.55.0-aikido.2v0.55.0-aikido.3v0.45.0-aikido.3v0.27.0-aikido.1v0.21.0-aikido.1v0.35.0-aikido.6v0.38.0-aikido.1v0.27.0-aikido.2v0.21.0-aikido.2v0.55.0-aikido.4v0.55.0-aikido.5
rootio-golang.org/x/crypto
Root:Go
 before v0.48.0-root.io.2
v0.48.0-root.io.2v0.55.0-root.io.1v0.37.0-root.io.6v0.54.0-root.io.2v0.52.0-root.io.3v0.54.0-root.io.3v0.40.0-root.io.8v0.40.0-root.io.9v0.53.0-root.io.2v0.53.0-root.io.3v0.32.0-root.io.6v0.47.0-root.io.1v0.47.0-root.io.2v0.49.0-root.io.4v0.31.0-root.io.12v0.36.0-root.io.3v0.31.0-root.io.10v0.31.0-root.io.11v0.46.0-root.io.3v0.55.0-root.io.2v0.55.0-root.io.3v0.35.0-root.io.6v0.45.0-root.io.3v0.27.0-root.io.1v0.21.0-root.io.1v0.38.0-root.io.1v0.27.0-root.io.2v0.21.0-root.io.2v0.55.0-root.io.4v0.55.0-root.io.5
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 39 CVEs
 before 0.0.20260902T191204-160000.1.1
0.0.20260902T191204-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 39 CVEs
 before 0.0.20260902T191204-160000.1.1
0.0.20260902T191204-160000.1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 7 CVEs
 before 20260903.01-slfo.1.1_1.1
20260903.01-slfo.1.1_1.1
google-osconfig-agent
SUSE:Linux Micro 6.1
From an advisory covering 7 CVEs
 before 20260908.00-slfo.1.1_1.1
20260908.00-slfo.1.1_1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 4 CVEs
 before 20260903.01-slfo.1.1_2.1
20260903.01-slfo.1.1_2.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 7 CVEs
 before 20260903.01-1.1
20260903.01-1.1
google-osconfig-agent
SUSE:Linux Micro 6.0
From an advisory covering 3 CVEs
 before 20260908.00-2.1
20260908.00-2.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 4 CVEs
 before 20260903.01-2.1
20260903.01-2.1
google-osconfig-agent
SUSE:Linux Micro 6.0
From an advisory covering 4 CVEs
 before 20260911.00-1.1
20260911.00-1.1
google-osconfig-agent
SUSE:Linux Micro 6.1
From an advisory covering 4 CVEs
 before 20260911.00-slfo.1.1_1.1
20260911.00-slfo.1.1_1.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
alloy
SUSE:Linux Enterprise Server 16.0
From an advisory covering 19 CVEs
 before 1.19.2-160000.1.1
1.19.2-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 19 CVEs
 before 1.19.2-160000.1.1
1.19.2-160000.1.1
cosign
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 3.1.3-160000.1.1
3.1.3-160000.1.1
cosign
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 3.1.3-160000.1.1
3.1.3-160000.1.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 20 CVEs
 before 4.3.0-slfo.1.1_1.1
4.3.0-slfo.1.1_1.1
containerized-data-importer
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 27 CVEs
 before 1.64.0-150700.9.14.1
1.64.0-150700.9.14.1
google-guest-agent
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 8 CVEs
 before 20260903.01-150000.1.85.1
20260903.01-150000.1.85.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 8 CVEs
 before 20260903.01-150000.1.85.1
20260903.01-150000.1.85.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 8 CVEs
 before 20260903.01-150000.1.85.1
20260903.01-150000.1.85.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 8 CVEs
 before 20260903.01-150000.1.85.1
20260903.01-150000.1.85.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 8 CVEs
 before 20260903.01-150000.1.85.1
20260903.01-150000.1.85.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 12
From an advisory covering 8 CVEs
 before 20260903.01-1.75.1
20260903.01-1.75.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 12
From an advisory covering 5 CVEs
 before 3.3.5390.0-4.52.1
3.3.5390.0-4.52.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 12
From an advisory covering 8 CVEs
 before 20260911.00-1.60.1
20260911.00-1.60.1
google-osconfig-agent
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 8 CVEs
 before 20260911.00-150000.1.67.1
20260911.00-150000.1.67.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 8 CVEs
 before 20260911.00-150000.1.67.1
20260911.00-150000.1.67.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 8 CVEs
 before 20260911.00-150000.1.67.1
20260911.00-150000.1.67.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 8 CVEs
 before 20260911.00-150000.1.67.1
20260911.00-150000.1.67.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 8 CVEs
 before 20260911.00-150000.1.67.1
20260911.00-150000.1.67.1
apptainer
SUSE:Linux Enterprise Module for HPC 15 SP7
From an advisory covering 6 CVEs
 before 1.5.3-150600.4.43.1
1.5.3-150600.4.43.1
apptainer
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 6 CVEs
 before 1.5.3-150600.4.43.1
1.5.3-150600.4.43.1
apptainer
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 1.5.3-150600.4.43.1
1.5.3-150600.4.43.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 3 CVEs
 before 3.3.5390.0-150000.5.43.1
3.3.5390.0-150000.5.43.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 3 CVEs
 before 3.3.5390.0-150000.5.43.1
3.3.5390.0-150000.5.43.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 3 CVEs
 before 3.3.5390.0-150000.5.43.1
3.3.5390.0-150000.5.43.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 3 CVEs
 before 3.3.5390.0-150000.5.43.1
3.3.5390.0-150000.5.43.1
cosign
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 3.1.3-150400.3.57.1
3.1.3-150400.3.57.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 19 CVEs
 before 1.19.2-150700.15.29.1
1.19.2-150700.15.29.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.11.0-150200.6.29.2
3.11.0-150200.6.29.2
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.32.0-150200.6.23.2
2.32.0-150200.6.23.2
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.23.2
2.0.0-150200.6.23.2
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.43.0-150200.6.23.2
3.43.0-150200.6.23.2
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.9.0-150200.6.34.2
2.9.0-150200.6.34.2
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 1.13.2-150200.6.23.2
1.13.2-150200.6.23.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.30.2
2.0.0-150200.6.30.2
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.32.2
3.0.0-150200.6.32.2
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.26.2
3.0.0-150200.6.26.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 9 CVEs
 before 3.0.0-150200.5.26.2
3.0.0-150200.5.26.2
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.11.0-150200.6.29.2
3.11.0-150200.6.29.2
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.32.0-150200.6.23.2
2.32.0-150200.6.23.2
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.23.2
2.0.0-150200.6.23.2
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.43.0-150200.6.23.2
3.43.0-150200.6.23.2
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.9.0-150200.6.34.2
2.9.0-150200.6.34.2
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 1.13.2-150200.6.23.2
1.13.2-150200.6.23.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 2.0.0-150200.6.30.2
2.0.0-150200.6.30.2
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.32.2
3.0.0-150200.6.32.2
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.0.0-150200.6.26.2
3.0.0-150200.6.26.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 9 CVEs
 before 3.0.0-150200.5.26.2
3.0.0-150200.5.26.2
golang-defaults
Ubuntu:16.04:LTS
 All versions, plus listed versions
2:1.6-1ubuntu32:1.6-1ubuntu4
 None known
golang-defaults
Ubuntu:18.04:LTS
 All versions, plus listed versions
2:1.8~1ubuntu12:1.9~2ubuntu12:1.10~4ubuntu1
 None known
golang-defaults
Ubuntu:20.04:LTS
 All versions, plus listed versions
2:1.12~1ubuntu12:1.13~1ubuntu12:1.13~1ubuntu2
 None known
golang-1.20
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu0.1~20.041.20.3-1ubuntu0.1~20.04.1
 None known
golang-1.21
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.21.1-1~ubuntu20.04.11.21.1-1~ubuntu20.04.21.21.1-1~ubuntu20.04.3
 None known
golang-1.17
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3
 None known
golang-1.20
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu0.1~22.041.20.3-1ubuntu0.1~22.04.1
 None known
golang-1.21
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.21.1-1~ubuntu22.04.11.21.1-1~ubuntu22.04.21.21.1-1~ubuntu22.04.31.21.1-1~ubuntu22.04.4
 None known
golang-1.23
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.23.1-1~22.041.23.1-1~22.04.21.23.1-1~22.04.3
 None known
golang-1.24
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu1~22.04.11.24.4-1ubuntu1~22.04.21.24.13-2~22.04.11.24.13-2~22.04.2
 None known
golang-1.25
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.25.14-1~ubuntu0.22.04.1
 None known
golang-1.26
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.26.8-1~ubuntu0.22.04.2
 None known
golang-defaults
Ubuntu:22.04:LTS
 All versions, plus listed versions
2:1.17~0ubuntu12:1.17~12:1.18~0ubuntu12:1.18~0ubuntu2
 None known
golang-1.21
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.21.1-11.21.3-11.21.4-11.21.5-11.21.6-1
Show 6 moreShow less
1.21.7-11.21.7-21.21.8-11.21.8-1build11.21.9-11.21.9-1ubuntu0.1
 None known
golang-1.23
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.23.1-1~24.041.23.1-1~24.04.1
 None known
golang-1.24
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu1~24.04.11.24.4-1ubuntu1~24.04.21.24.13-2~24.04.1
 None known
golang-1.25
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.25.14-1~ubuntu0.24.04.1
 None known
golang-1.26
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.26.8-1~ubuntu0.24.04.2
 None known
golang-defaults
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:1.21~22:1.21~32:1.22~22:1.22~2build1
 None known
golang-1.26
Ubuntu:26.10
 All versions, plus listed versions
1.26.0-11.26.2-31.26.4-11.26.5-11.26.6-21.26.7-11.26.8-11.26.8-2
 None known
golang-1.27
Ubuntu:26.10
 All versions, plus listed versions
1.27~rc1-11.27~rc2-11.27~rc3-11.27.0-11.27.1-1
 None known
golang-defaults
Ubuntu:26.10
 All versions, plus listed versions
2:1.26~12:1.27~1
 None known
golang-1.23
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.23.10-1
 None known
golang-1.24
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu11.24.9-11.24.13-2
 None known
golang-1.25
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.25.0-0ubuntu11.25.7-21.25.14-1~ubuntu0.26.04.1
 None known
golang-1.26
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.26~rc3-21.26.0-11.26.8-1~ubuntu0.26.04.2
 None known
golang-defaults
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:1.24~22:1.25~12:1.26~1
 None known
rclone
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.75.1-1.1
1.75.1-1.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 1.8.4-7.1
1.8.4-7.1
zk
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.15.7-1.1
0.15.7-1.1
buildpacks-cli
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.40.10-1.1
0.40.10-1.1
trivy
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 0.74.0-160000.2.1
0.74.0-160000.2.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 0.0.20260902T191204-160000.1.1
0.0.20260902T191204-160000.1.1
zk
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 0.15.6-bp160.2.1
0.15.6-bp160.2.1
hauler
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 2.1.0-bp160.2.1
2.1.0-bp160.2.1
containerized-data-importer1.65
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 1.65.0-160000.3.1
1.65.0-160000.3.1
trivy
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 0.74.0-160000.3.1
0.74.0-160000.3.1
hauler
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 2.1.0-bp160.3.1
2.1.0-bp160.3.1
keybase-client
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 6.6.3-bp160.3.1
6.6.3-bp160.3.1
gh
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 2.100.0-bp160.1.1
2.100.0-bp160.1.1
google-guest-agent
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 20260903.01-160000.1.1
20260903.01-160000.1.1
google-osconfig-agent
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 20260911.00-160000.1.1
20260911.00-160000.1.1
amazon-ssm-agent
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 3.3.5390.0-160000.1.1
3.3.5390.0-160000.1.1
cloudflared
openSUSE:Leap 16.0
From an advisory covering 17 CVEs
 before 2026.9.1-bp160.1.1
2026.9.1-bp160.1.1
apptainer
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.5.3-bp160.4.1
1.5.3-bp160.4.1
helm
openSUSE:Leap 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
rclone
openSUSE:Leap 16.0
From an advisory covering 12 CVEs
 before 1.75.1-bp160.1.1
1.75.1-bp160.1.1
alloy
openSUSE:Leap 16.0
From an advisory covering 19 CVEs
 before 1.19.2-160000.1.1
1.19.2-160000.1.1
cosign
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 3.1.3-160000.1.1
3.1.3-160000.1.1

History

History
RecordedChangedSources
affected
affectedOSV
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78662 is a high vulnerability (CVSS 7.5) in Golang Crypto, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in cert-manager 1.12.15-14.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 78 references and the rest of 1 source description. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 19 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open