CVE-2026-89090

Root has patched GHSA-xmrv-pmrh-hhx2 in the rootio-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs package for Root:Go. Multiple fixed versions available.

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kbfs-6.6.3-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-ecs-init-1.108.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rqlite-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.0-3.1 package on the GA media of openSUSE Tumbleweed.

This update for keybase-client fixes the following issues:

Changes in keybase-client:

• CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for amazon-ecs-init fixes the following issues:

• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679).

Changes for amazon-ecs-init:

• Update to version 1.108.0

• Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161)
• Enhancement - Remove direct docker run instructions from README (#5160)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1 to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)
• Feature - Enable IMDS IAM roles config resolution (#5154)
• Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.36 in /agent (#5155)
• Enhancement - Bump github.com/containerd/containerd from 1.7.35 to 1.7.36 in /ecs-init (#5156)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)
• Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153) (bsc#1279042, CVE-2026-84445)
• Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/ otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)
• Enhancement - IMDS credential scanner/refresher updates (#5145)

This update for rqlite fixes the following issues:

Changes in rqlite:

• Update to version 10.6.6:

  • Keep the local auto-backup file if the metadata rename fails
  • Reject local auto-backup filenames reserved for internal use
  • POST /demote and POST /promote return a JSON error body, and 404 when the target node is not in the cluster.
  • DELETE /remove returns a JSON error body.

• Includes changes from version 10.6.5:

  • Guard the inter-node backup stream handler directly against a missing backup request
  • POST /leader returns a JSON error body, and 404 when the target node is not in the cluster

• Update to version 10.6.4:

  • BACKUP_STREAM authorization failures can disclose the database and crash rqlited (boo#1286934)
  • GET /leader returns a JSON error body when there is no leader
  • Close the connection after rejecting an unauthorized inter-node backup stream request, instead of streaming the database anyway
  • Decide inter-node command authorization once, before dispatch, and close the connection after rejecting any unauthorized command

• Update to version 10.6.3:

  • Node probes honor request context and commit exactly one result
  • Make DB connections a first-class object
  • Prevent ATTACH on the query database connection

• Update to version 10.6.2:

  • Check for trailing junk in request bodies
  • Console schema view handles table names that collide with JavaScript object properties
  • Set CommitTimestamps in CDC Events Group
  • Upgrade dependencies

• Update to version 10.6.1:

  • Use constant-time comparison when comparing passwords
  • Conditionally rewrite SQL during queued writes and fix rewriting of CURRENT_TIMESTAMP and related tokens
  • More robust Leader stepdown node ID detection, reap checks, and SQL analyze start-time recording
  • CDC fixes: encode non-finite floats, always release flush waiters, and make the HTTP sink follow redirects
  • Converted _service from mode=disabled to mode=manual (legacy leftover; services are run by hand via osc service manualrun)
  • Package is not affected by CVE-2026-84445 (boo#1278793), CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253): vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
  • Package is not affected by CVE-2026-89090 (boo#1280657): vendored eventstream is v1.7.20, above the v1.7.8 fix
  • Package is not affected by CVE-2026-63209 (boo#1283555): vendored klauspost/compress is v1.20.1, above the v1.18.7 fix
  • Package is not affected by CVE-2026-39821 (boo#1266544): vendored golang.org/x/net is v0.59.0, above the v0.55.0 fix

• Update to version 10.6.0:

  • API addition: error_v2 may contain numeric SQLite error codes.
  • addresses a security issue related to Authentication files. A user with no explicit permissions could be grant elevated permissions. Correctly configured users do not suffer from this issue.
  • multiple implementation changes and bug fixes
  • Display interactive cluster topology on web console.
  • Support configurable queued-writes retries
  • release addresses a gap in the role-based access permissions related to change-data-capture (CDC) handling

• Update to version 10.3.6:

  • Add query logging to database layer
  • Snapshot IDs now contain (optional) generation
  • Bump generation ID if snapshot IDs collide
  • Snapshots can be filtered by term and index
  • Add support for File Renaming and Removing with retries
  • Replace standard library with fsutil
  • Keep snapshot ordering correct regardless of clock
  • Remove snapshot name generation ID

• Update to version 10.3.5:

  • Reject alternate form of unsupported PRAGMA commands
  • Handle negative trailing logs
  • Sync access to last backup time at http layer
  • Set the "Served by" header before first backup byte
  • Set DB load response time for all formats
  • Fix HTTP logic error for queued statements
  • Minor web console fixes

• includes…

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

Update to version 1.19.2:

• Remove withdrawn lib/pq CVEs from govulncheck
• Add backticks to component name in generated doc output
• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
• Add nop receiver to OTel Engine
• Backport dependency upgrades to address GO-2026-6061

This update for amazon-ecs-init fixes the following issues:

• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279042).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280679).

Changes for amazon-ecs-init:

• Update to version 1.108.0

• Enhancement - Add ECS-Init install pointer for non-Amazon Linux AMIs to README (#5161)
• Enhancement - Remove direct docker run instructions from README (#5160)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1 to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)
• Feature - Enable IMDS IAM roles config resolution (#5154)
• Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.36 in /agent (#5155)
• Enhancement - Bump github.com/containerd/containerd from 1.7.35 to 1.7.36 in /ecs-init (#5156)
• Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)
• Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153) (bsc#1279042, CVE-2026-84445)
• Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/ otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)
• Enhancement - IMDS credential scanner/refresher updates (#5145)

This update for alloy fixes the following issues:

• CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
• CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
• CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
• CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
• CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
• CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
• CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled writev buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487).
• CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
• CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
• CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
• CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
• CVE-2026-75889: arbitrary file reads due to the prometheus.operator.servicemonitors component allowing users who can modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile (bsc#1277429).
• CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
• CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).

Changes for alloy:

• Update to version 1.19.2.
• Update to version 1.19.1.
• Update to version 1.19.0:

• BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
• prometheus.enrich: Support multi-label matching
• prometheus.relabel: Add opt-in TTL cache mode
• telemetry: Add new metrics for graph connections and pyroscope forwarded entries
• database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans

• Update to version 1.18.1:

• Add nop receiver to OTel Engine