Every CVE Search/ Get API key

CVE-2026-48978

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

2.1 LowFix available

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.21%Unchanged since Jul 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.1

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Record
CVE-2026-48978
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-918, CWE-319
Updated
2026-11-02
EUVDEUVD-2026-45295 2.1

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Record
EUVD-2026-45295
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xf85-363p-868w 2.1

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Summary

oras-go's auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating its scheme or host. The realm field is server-controlled by design in the OCI/distribution spec — registries legitimately point token requests at a separate auth endpoint (e.g. Docker Hub's registry-1.docker.io -> auth.docker.io), so cross-host realms on public DNS names are not in themselves a vulnerability. Two specific patterns, however, are never legitimate under any registry trust model and can be abused by a malicious or compromised registry (or a man-in-the-middle on a plaintext connection):

  1. SSRF to internal networks. A realm of http://169.254.169.254/... (AWS/Azure IMDS), http://10.0.0.x/... (RFC 1918), or http://127.0.0.1/... causes oras-go running on a cloud VM or corporate workstation to issue outbound HTTP requests from inside the user's trust boundary to an endpoint the user did not choose. The user's stored credentials are attached to those requests, but the principal harm is the network primitive — probing internal endpoints from the client. On IMDSv1 the response body is recoverable from log channels; on IMDSv2 the probe itself can still be used for service discovery.

  2. TLS downgrade. A registry contacted over https:// can return a realm with an http:// scheme, causing oras-go to send the user's credentials over plaintext to the token endpoint. This defeats the transport security the user chose when typing https://.

What is NOT claimed

This advisory does not claim that credential forwarding to an arbitrary public attacker host through a server-controlled realm is, on its own, a vulnerability. The distribution spec defines realm as a server-controlled field; a strict same-host or same-eTLD+1 enforcement would deviate from the spec and break legitimate split-host deployments. Operators who want defense-in-depth against cross-host realm forwarding can use the opt-in Client.TrustedRealmHosts allowlist (added separately).

Affected versions

oras.land/oras-go/v2 <= v2.6.0

Severity

Medium. Network attack vector, low complexity, no privileges required, user interaction required (victim runs an oras command against the malicious or MITM'd registry), unchanged scope. Confidentiality impact is limited — IMDS probe responses can disclose information, and TLS downgrade exposes the realm request to passive observers — but the attacker does not obtain credentials beyond what the malicious endpoint already controls.

Affected code

  • registry/remote/auth/client.go — Client.Do() (bearer challenge handling)
  • registry/remote/auth/client.go — Client.fetchBearerToken() / fetchDistributionToken / fetchOAuth2Token

The realm parameter from parseChallenge is threaded through to http.NewRequestWithContext without scheme or host validation.

CWE

  • CWE-918: Server-Side Request Forgery (SSRF)
  • CWE-319: Cleartext Transmission of Sensitive Information

Patch

registry/remote/auth/client.go now rejects realm URLs that:

  • use a scheme other than http or https
  • use http when the registry was contacted over https (TLS downgrade)
  • use an IP literal in a loopback, link-local, private, or unspecified range, unless the registry itself was reached at the same hostname (so loopback / in-cluster deployments are unaffected)

Cross-host realms on public DNS names continue to be accepted.

Credit

Reported by bugbunny.ai.

Record
GHSA-xf85-363p-868w
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-319, CWE-918
Updated
2026-11-02
NVD 2.1

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Record
CVE-2026-48978
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-319, CWE-918
Updated
2026-11-02
OSV 2.1

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Record
CVE-2026-48978
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-319, CWE-918
Updated
2026-11-02
OSVDEBIAN-CVE-2026-48978 2.1

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Record
DEBIAN-CVE-2026-48978
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 23 moreShow less
OSVGHSA-xf85-363p-868w 2.1

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Summary

oras-go's auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating its scheme or host. The realm field is server-controlled by design in the OCI/distribution spec — registries legitimately point token requests at a separate auth endpoint (e.g. Docker Hub's registry-1.docker.io -> auth.docker.io), so cross-host realms on public DNS names are not in themselves a vulnerability. Two specific patterns, however, are never legitimate under any registry trust model and can be abused by a malicious or compromised registry (or a man-in-the-middle on a plaintext connection):

  1. SSRF to internal networks. A realm of http://169.254.169.254/... (AWS/Azure IMDS), http://10.0.0.x/... (RFC 1918), or http://127.0.0.1/... causes oras-go running on a cloud VM or corporate workstation to issue outbound HTTP requests from inside the user's trust boundary to an endpoint the user did not choose. The user's stored credentials are attached to those requests, but the principal harm is the network primitive — probing internal endpoints from the client. On IMDSv1 the response body is recoverable from log channels; on IMDSv2 the probe itself can still be used for service discovery.

  2. TLS downgrade. A registry contacted over https:// can return a realm with an http:// scheme, causing oras-go to send the user's credentials over plaintext to the token endpoint. This defeats the transport security the user chose when typing https://.

What is NOT claimed

This advisory does not claim that credential forwarding to an arbitrary public attacker host through a server-controlled realm is, on its own, a vulnerability. The distribution spec defines realm as a server-controlled field; a strict same-host or same-eTLD+1 enforcement would deviate from the spec and break legitimate split-host deployments. Operators who want defense-in-depth against cross-host realm forwarding can use the opt-in Client.TrustedRealmHosts allowlist (added separately).

Affected versions

oras.land/oras-go/v2 <= v2.6.0

Severity

Medium. Network attack vector, low complexity, no privileges required, user interaction required (victim runs an oras command against the malicious or MITM'd registry), unchanged scope. Confidentiality impact is limited — IMDS probe responses can disclose information, and TLS downgrade exposes the realm request to passive observers — but the attacker does not obtain credentials beyond what the malicious endpoint already controls.

Affected code

  • registry/remote/auth/client.go — Client.Do() (bearer challenge handling)
  • registry/remote/auth/client.go — Client.fetchBearerToken() / fetchDistributionToken / fetchOAuth2Token

The realm parameter from parseChallenge is threaded through to http.NewRequestWithContext without scheme or host validation.

CWE

  • CWE-918: Server-Side Request Forgery (SSRF)
  • CWE-319: Cleartext Transmission of Sensitive Information

Patch

registry/remote/auth/client.go now rejects realm URLs that:

  • use a scheme other than http or https
  • use http when the registry was contacted over https (TLS downgrade)
  • use an IP literal in a loopback, link-local, private, or unspecified range, unless the registry itself was reached at the same hostname (so loopback / in-cluster deployments are unaffected)

Cross-host realms on public DNS names continue to be accepted.

Credit

Reported by bugbunny.ai.

Record
GHSA-xf85-363p-868w
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-319, CWE-918
Updated
2026-11-02
OSVUBUNTU-CVE-2026-48978 2.1

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Record
UBUNTU-CVE-2026-48978
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVGO-2026-5885 No score

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Record
GO-2026-5885
Updated
2026-11-02
OSVopenSUSE-SU-2026:11186-1 No score

helm-4.2.2-2.1 on GA media

These are all security issues fixed in the helm-4.2.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11186-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11187-1 No score

helm3-3.21.2-2.1 on GA media

These are all security issues fixed in the helm3-3.21.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11187-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21331-1 No score

Security update for helm

This update for helm fixes the following issue

  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).

Changes for helm:

  • Update to version 3.21.2.
Record
openSUSE-SU-2026:21331-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
openSUSE-SU-2026:21551-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21809-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.1:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21809-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21983-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
openSUSE-SU-2026:21983-1
Updated
2026-11-02
OSVSUSE-SU-2026:22603-1 No score

Security update for helm

This update for helm fixes the following issue

  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).

Changes for helm:

  • Update to version 3.21.2.
Record
SUSE-SU-2026:22603-1
Updated
2026-11-02
OSVSUSE-SU-2026:22650-1 No score

Security update for helm

This update for helm fixes the following issue

  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).

Changes for helm:

  • Update to version 3.21.2.
Record
SUSE-SU-2026:22650-1
Updated
2026-11-02
OSVSUSE-SU-2026:23052-1 No score

Security update for helm

This update for helm fixes the following issues

Update to version 3.21.3.

  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: missing validation in auth.Client() allows a malicious registry to hijack Bearer token realms to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing truncated/invalid UTF-8 input can lead to infinite loop (bsc#1271997).

Changes for helm:

  • Update x/text to 0.40.0.
  • Update x/net to 0.57.0.
  • Update to version 3.21.3:
    • Apply suggestions from code review 1ad6e68 (Benoit Tigeot).
    • fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e (Benoit Tigeot).
    • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178b (dependabot[bot]).
Record
SUSE-SU-2026:23052-1
Updated
2026-11-02
OSVSUSE-SU-2026:23162-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.3.

  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: missing validation in auth.Client() allows a malicious registry to hijack Bearer token realms to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing truncated/invalid UTF-8 input can lead to infinite loop (bsc#1271997).

Changes for helm:

  • Update x/text to 0.40.0.
  • Update x/net to 0.57.0.
  • Update to version 3.21.3:
    • Apply suggestions from code review 1ad6e68 (Benoit Tigeot).
    • fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e (Benoit Tigeot).
    • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178b (dependabot[bot]).
Record
SUSE-SU-2026:23162-1
Updated
2026-11-02
OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
SUSE-SU-2026:23216-1
Updated
2026-11-02
OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
SUSE-SU-2026:23227-1
Updated
2026-11-02
OSVSUSE-SU-2026:23456-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23456-1
Updated
2026-11-02
OSVSUSE-SU-2026:23506-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.1:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23506-1
Updated
2026-11-02
OSVSUSE-SU-2026:23522-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23522-1
Updated
2026-11-02
OSVSUSE-SU-2026:23688-1 No score

Security update for helm

This update for helm fixes the following issues:

Update to version 3.21.1:

  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276644).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402).
  • CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270).
  • CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1278688).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23688-1
Updated
2026-11-02
OSVSUSE-SU-2026:23973-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23973-1
Updated
2026-11-02
OSVSUSE-SU-2026:23984-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
  • CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).
Record
SUSE-SU-2026:23984-1
Updated
2026-11-02
OSVSUSE-SU-2026:24282-1 No score

Security update for helm

This update for helm fixes the following issues:

  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
  • CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
  • CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
  • CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
  • CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
  • CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
  • CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426).
  • CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
  • CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
  • CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
  • CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
  • gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

  • update to 4.3.0:
  • feat: Add duration functions
  • feat(engine): add debug logging when lookup returns empty
  • feat: add ownership verification before deleting resources
  • feat: honor SOURCE_DATE_EPOCH for chart archives
  • feat(rollback): add --description flag to provide rollback reason
  • fix (internal/plugin): remove zero-width spaces from plugin name comment
  • fix(loader): do not drop values files ending at a 4096-byte boundary
  • fix(chart): normalize StampModTimes timestamp to UTC/truncate
  • Chart.lock reproducibility test
  • fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
  • fix(template): regression - route registry messages to stderr in template and show
  • refactor: lower resync period from one hour to 3 minutes
  • perf: enable concurrent status computation to prevent multi-minute delays
  • fix: Improve error reporting for helm template --debug with --show-only- #31185
  • fix: fetch logs from all containers in test pods- #32099
  • fix(provenance): check error return in Digest and encodeRelease- #32136
  • fix panic on repeated IsReachable calls- #32184
  • fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211
  • Fix missing conflict retry with server-side apply- #32088
  • Properly format the extra field in gzipped…
Record
SUSE-SU-2026:24282-1
Updated
2026-11-02
OSVSUSE-SU-2026:2823-1 No score

Security update for helm

This update for helm fixes the following issues

  • Update to version 3.21.2
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
Record
SUSE-SU-2026:2823-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
oras.land/oras-go/v2
Go
 before 2.6.1
2.6.1
oras.land/oras-go
Go
 through 1.2.7 None known
golang-oras-oras-go
Debian:12
 All versions, plus listed versions
1.1.1-12.5.0-12.6.0-12.6.2-12.6.2-2
 None known
golang-oras-oras-go
Debian:13
 All versions, plus listed versions
2.5.0-12.6.0-12.6.2-12.6.2-2
 None known
golang-oras-oras-go
Debian:14
 before 2.6.2-1, plus listed versions
2.5.0-12.6.0-1
2.6.2-1
helm
SUSE:Linux Micro 6.2
 before 3.21.2-160000.2.2
3.21.2-160000.2.2
helm
SUSE:Linux Enterprise Server 16.0
 before 3.21.2-160000.2.2
3.21.2-160000.2.2
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.21.2-160000.2.2
3.21.2-160000.2.2
helm
SUSE:Linux Micro 6.0
From an advisory covering 3 CVEs
 before 3.21.3-1.1
3.21.3-1.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 3.21.3-slfo.1.1_1.1
3.21.3-slfo.1.1_1.1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 77 CVEs
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 77 CVEs
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
c-ares
SUSE:Linux Micro 6.2
From an advisory covering 5 CVEs
 before 1.34.8-160000.1.1
1.34.8-160000.1.1
helm
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 3.21.3-2.1
3.21.3-2.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 3.21.3-slfo.1.1_2.1
3.21.3-slfo.1.1_2.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
helm
SUSE:Linux Micro 6.2
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1
helm
SUSE:Linux Micro 6.1
From an advisory covering 20 CVEs
 before 4.3.0-slfo.1.1_1.1
4.3.0-slfo.1.1_1.1
helm
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 3.21.2-150000.1.80.1
3.21.2-150000.1.80.1
golang-oras-oras-go
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.1.1-1ubuntu1
 None known
golang-oras-oras-go
Ubuntu:26.10
 All versions, plus listed versions
2.6.0-12.6.2-1
 None known
golang-oras-oras-go
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.5.0-12.6.0-1
 None known
helm
openSUSE:Tumbleweed
 before 4.2.2-2.1
4.2.2-2.1
helm3
openSUSE:Tumbleweed
 before 3.21.2-2.1
3.21.2-2.1
helm
openSUSE:Leap 16.0
 before 3.21.2-160000.2.1
3.21.2-160000.2.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 77 CVEs
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
helm
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 3.21.3-160000.2.1
3.21.3-160000.2.1
helm
openSUSE:Leap 16.0
From an advisory covering 18 CVEs
 before 4.3.0-160000.1.1
4.3.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-48978 is a low vulnerability (CVSS 2.1) in Oras-project Oras-go, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in oras.land/oras-go/v2 2.6.1.

References

Show 140 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open