Every CVE Search/ Get API key

CVE-2026-41506

go-git Credential leak via cross-host redirect in smart HTTP transport

4.7 MediumFix available

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.26%Up 0.2 points since May 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.7

go-git Credential leak via cross-host redirect in smart HTTP transport

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Record
CVE-2026-41506
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
EUVDEUVD-2026-28596 4.7

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Record
EUVD-2026-28596
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3xc5-wrhm-f963 4.7

go-git: Credential leak via cross-host redirect in smart HTTP transport

Impact

go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.

If a remote repository responds to the initial /info/refs request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.

An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.

Clients using go-git exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue. The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.

Patches

Users should upgrade to v5.18.0, or v6.0.0-alpha.2, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

The patched versions add support for configuring followRedirects. In line with upstream behaviour, the default is now initial, while users can opt into FollowRedirects or NoFollowRedirects programmatically.

Credit

Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the go-git project. :bow:

Record
GHSA-3xc5-wrhm-f963
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
NVD 4.7

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Record
CVE-2026-41506
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSV 4.7

go-git Credential leak via cross-host redirect in smart HTTP transport

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Record
CVE-2026-41506
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVDEBIAN-CVE-2026-41506 7.4

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Record
DEBIAN-CVE-2026-41506
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
Show 31 moreShow less
OSVGHSA-3xc5-wrhm-f963 4.7

go-git: Credential leak via cross-host redirect in smart HTTP transport

Impact

go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.

If a remote repository responds to the initial /info/refs request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.

An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.

Clients using go-git exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue. The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.

Patches

Users should upgrade to v5.18.0, or v6.0.0-alpha.2, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

The patched versions add support for configuring followRedirects. In line with upstream behaviour, the default is now initial, while users can opt into FollowRedirects or NoFollowRedirects programmatically.

Credit

Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the go-git project. :bow:

Record
GHSA-3xc5-wrhm-f963
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVRHSA-2026:17669 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:17669
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:35111 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:35111
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41506 4.7

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.

Record
UBUNTU-CVE-2026-41506
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2026-5105 No score

Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git

Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git

Record
GO-2026-5105
Updated
2026-11-02
OSVopenSUSE-SU-2026:10765-1 No score

amazon-ssm-agent-3.3.4268.0-2.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.4268.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10765-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10771-1 No score

google-osconfig-agent-20260511.00-1.1 on GA media

These are all security issues fixed in the google-osconfig-agent-20260511.00-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10771-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10803-1 No score

git-bug-0.10.1-4.1 on GA media

These are all security issues fixed in the git-bug-0.10.1-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10803-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10830-1 No score

trivy-0.70.0-2.1 on GA media

These are all security issues fixed in the trivy-0.70.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10830-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10967-1 No score

cheat-5.1.0-2.1 on GA media

These are all security issues fixed in the cheat-5.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10967-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11438-1 No score

alloy-1.18.0-1.1 on GA media

These are all security issues fixed in the alloy-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11438-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20720-1 No score

Security update for trivy

This update for trivy fixes the following issues:

Changes in trivy:

  • update go-git to 5.18.0 (bsc#1264873, CVE-2026-41506)
Record
openSUSE-SU-2026:20720-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20770-1 No score

Security update for git-bug

This update for git-bug fixes the following issues:

Changes in git-bug:

  • CVE-2026-1229: CIRCL had an incorrect calculation in secp384r1 CombinedMult (bsc#1265416, GO-2026-4550): updated github.com/cloudflare/circl to v1.6.3
  • CVE-2026-41506: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264955, GO-2026-4910): updated github.com/go-git/go-git/v5 to v5.17.1
Record
openSUSE-SU-2026:20770-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20809-1 No score

Security update for trivy

This update for trivy fixes the following issues

  • CVE-2025-64702: github.com/quic-go/quic-go/http3: quic-go HTTP/3 QPACK Header Expansion DoS (bsc#1255366).
  • CVE-2025-69725: github.com/go-chi/chi/v5: incorrect input validation in the RedirectSlashes function can lead to an open redirect (bsc#1258513).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258094).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260193).
  • CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written outside of the BuildKit state directory (bsc#1260971).
  • CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository (bsc#1261052).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262893).
  • CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262389).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264873).

Changes for trivy:

  • Updated go-git to 5.18.0.
  • Updated to version 0.70.0.
Record
openSUSE-SU-2026:20809-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21079-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
openSUSE-SU-2026:21079-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21210-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues

  • CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

  • Update to version 20260615.01
  • Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
  • from version 20260615.00
  • Add unit tests for ospatch_apt_upgrade.go (#938)
  • Update to version 20260611.00
  • Add unit tests for policies/policies.go PART 5 (#998)
  • from version 20260610.00
  • Add unit tests for policies/policies.go PART 4 (#997)
  • from version 20260609.02
  • squash commits (#936)
  • from version 20260609.01
  • Add unit tests for policies/policies.go PART 3 (#996)
  • from version 20260609.00
  • Add unit tests for policies/policies.go PART 2 (#991)
  • from version 20260602.01
  • Align format of dates and timestamp collected across Windows packages (#973)
  • from version 20260602.00
  • Add unit tests for config/config,go (#979)
  • from version 20260528.00
  • Bump github.com/containerd/containerd (#990)
  • from version 20260521.00
  • Cover agentconfig functionality by unit tests (#925)
  • from version 20260520.04
  • Add unit tests for policies/googet.go (#961)
  • Bump github.com/go-git/go-git/v5 (#987)
  • from version 20260520.02
  • Add unit tests for policies/yum.go (#952)
  • Add unit tests for policies/apt.go PART 3 (#951)
  • from version 20260520.00
  • Add unit tests for policies/zypper.go (#953)
  • from version…
Record
openSUSE-SU-2026:21210-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
openSUSE-SU-2026:21551-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21899-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
openSUSE-SU-2026:21899-1
Updated
2026-11-02
OSVSUSE-SU-2026:22157-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
SUSE-SU-2026:22157-1
Updated
2026-11-02
OSVSUSE-SU-2026:22242-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues

  • CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

  • Update to version 20260615.01
  • Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
  • from version 20260615.00
  • Add unit tests for ospatch_apt_upgrade.go (#938)
  • Update to version 20260611.00
  • Add unit tests for policies/policies.go PART 5 (#998)
  • from version 20260610.00
  • Add unit tests for policies/policies.go PART 4 (#997)
  • from version 20260609.02
  • squash commits (#936)
  • from version 20260609.01
  • Add unit tests for policies/policies.go PART 3 (#996)
  • from version 20260609.00
  • Add unit tests for policies/policies.go PART 2 (#991)
  • from version 20260602.01
  • Align format of dates and timestamp collected across Windows packages (#973)
  • from version 20260602.00
  • Add unit tests for config/config,go (#979)
  • from version 20260528.00
  • Bump github.com/containerd/containerd (#990)
  • from version 20260521.00
  • Cover agentconfig functionality by unit tests (#925)
  • from version 20260520.04
  • Add unit tests for policies/googet.go (#961)
  • Bump github.com/go-git/go-git/v5 (#987)
  • from version 20260520.02
  • Add unit tests for policies/yum.go (#952)
  • Add unit tests for policies/apt.go PART 3 (#951)
  • from version 20260520.00
  • Add unit tests for policies/zypper.go (#953)
  • from…
Record
SUSE-SU-2026:22242-1
Updated
2026-11-02
OSVSUSE-SU-2026:22249-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues

  • CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

  • Update to version 20260615.01
  • Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
  • from version 20260615.00
  • Add unit tests for ospatch_apt_upgrade.go (#938)
  • Update to version 20260611.00
  • Add unit tests for policies/policies.go PART 5 (#998)
  • from version 20260610.00
  • Add unit tests for policies/policies.go PART 4 (#997)
  • from version 20260609.02
  • squash commits (#936)
  • from version 20260609.01
  • Add unit tests for policies/policies.go PART 3 (#996)
  • from version 20260609.00
  • Add unit tests for policies/policies.go PART 2 (#991)
  • from version 20260602.01
  • Align format of dates and timestamp collected across Windows packages (#973)
  • from version 20260602.00
  • Add unit tests for config/config,go (#979)
  • from version 20260528.00
  • Bump github.com/containerd/containerd (#990)
  • from version 20260521.00
  • Cover agentconfig functionality by unit tests (#925)
  • from version 20260520.04
  • Add unit tests for policies/googet.go (#961)
  • Bump github.com/go-git/go-git/v5 (#987)
  • from version 20260520.02
  • Add unit tests for policies/yum.go (#952)
  • Add unit tests for policies/apt.go PART 3 (#951)
  • from version 20260520.00
  • Add unit tests for policies/zypper.go (#953)
  • from version…
Record
SUSE-SU-2026:22249-1
Updated
2026-11-02
OSVSUSE-SU-2026:22558-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues

  • CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

  • Update to version 20260615.01
  • Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
  • from version 20260615.00
  • Add unit tests for ospatch_apt_upgrade.go (#938)
  • Update to version 20260611.00
  • Add unit tests for policies/policies.go PART 5 (#998)
  • from version 20260610.00
  • Add unit tests for policies/policies.go PART 4 (#997)
  • from version 20260609.02
  • squash commits (#936)
  • from version 20260609.01
  • Add unit tests for policies/policies.go PART 3 (#996)
  • from version 20260609.00
  • Add unit tests for policies/policies.go PART 2 (#991)
  • from version 20260602.01
  • Align format of dates and timestamp collected across Windows packages (#973)
  • from version 20260602.00
  • Add unit tests for config/config,go (#979)
  • from version 20260528.00
  • Bump github.com/containerd/containerd (#990)
  • from version 20260521.00
  • Cover agentconfig functionality by unit tests (#925)
  • from version 20260520.04
  • Add unit tests for policies/googet.go (#961)
  • Bump github.com/go-git/go-git/v5 (#987)
  • from version 20260520.02
  • Add unit tests for policies/yum.go (#952)
  • Add unit tests for policies/apt.go PART 3 (#951)
  • from version 20260520.00
  • Add unit tests for policies/zypper.go (#953)
  • from version…
Record
SUSE-SU-2026:22558-1
Updated
2026-11-02
OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
SUSE-SU-2026:23216-1
Updated
2026-11-02
OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
  • GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
  • GO-2026-5048 GHSA-mx64-mj3q-7prj
  • GO-2026-5051
  • GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
  • GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
  • GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
  • GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
  • GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
  • GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
  • GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
  • GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
  • GO-2026-5309 GHSA-c3wq-j5vh-68rc
  • GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
  • GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
  • GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
  • GO-2026-5408 GHSA-gx7w-56w6-g48x
  • GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
  • GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
  • GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
  • GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
  • GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
  • GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
  • GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
  • GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
  • GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
  • GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
  • GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
  • GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
  • GO-2026-5569 GHSA-q76j-gcg9-vxc6
  • GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
  • GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
  • GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
  • GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
  • GO-2026-5606 GHSA-r46f-3rpw-hxrv
  • GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
  • GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
  • GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
  • GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
  • GO-2026-5693 GHSA-w5pp-99ch-qj29
  • GO-2026-5730 GHSA-wwhq-w58m-w29c
  • GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
  • GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
  • GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
  • GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
  • GO-2026-5774 GHSA-3fxj-6jh8-hvhx
  • GO-2026-5775 GHSA-9g5q-2w5x-hmxf
  • GO-2026-5777 GHSA-rjr7-jggh-pgcp
  • GO-2026-5781
  • GO-2026-5841 GHSA-259r-337f-4rfw
  • GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
  • GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
  • GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
  • GO-2026-5884 GHSA-vh4v-2xq2-g5cg
  • GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
  • GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
  • GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
  • GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
  • GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
  • GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
  • GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
  • GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
  • GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
  • GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
  • GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
  • GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
  • GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
  • GO-2026-6061 GHSA-hrxh-6v49-42gf
  • GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
  • GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
  • GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
  • GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
  • GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
  • GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
  • GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
  • GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
  • GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
  • GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
  • GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
  • GO-2026-6073 CVE-2026-58435…
Record
SUSE-SU-2026:23227-1
Updated
2026-11-02
OSVSUSE-SU-2026:23853-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
SUSE-SU-2026:23853-1
Updated
2026-11-02
OSVSUSE-SU-2026:23865-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout="1m", read_header_timeout="1m", write_timeout="30s" to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
SUSE-SU-2026:23865-1
Updated
2026-11-02
OSVSUSE-SU-2026:2467-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
SUSE-SU-2026:2467-1
Updated
2026-11-02
OSVSUSE-SU-2026:2468-1 No score

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues

Update to version 3.3.4624.0:

  • CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342).
  • CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).

Changes:

  • Bump golang.org/x/crypto from v0.51.0 to v0.52.0
  • Bump golang.org/x/net from v0.54.0 to v0.55.0
  • Enforce directory boundary in BuildSafePath
  • Fix visibility issue with Bottlerocket OS in document output
  • Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
  • Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
  • Quit if sysprep failed and log its current state
  • Remove attached legacy cloudwatch plugin packages
  • Upgrade Go version to 1.25.10
  • Use BuildSafePath wherever it is applicable
  • Add OOM killer protection to systemd service files
  • Apply more sanitation to file and registry inventory gatherers
  • Bump go-git to v5.17.1
  • Deprecate legacy cloudwatch plugin
  • Preserve network error details in credential refresher SSM API failures
  • Upgrade Go version to 1.25.9
  • Add SSM Distributor support for Bottlerocket OS
  • Implement flush credentials command in ssm-cli
  • Log ec2messages access denied as debug instead of error to reduce log noise
  • Make credential refresher refresh cache quickly…
Record
SUSE-SU-2026:2468-1
Updated
2026-11-02
OSVSUSE-SU-2026:2665-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260264).
  • CVE-2026-39821: Update golang.org/x/net/idna dependency (bsc#1266603).
  • CVE-2026-39827: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39828: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39829: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39830: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39831: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39832: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39833: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39834: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-39835: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-42508: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-46595: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-46597: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-46598: Update golang.org/x/crypto dependency (bsc#1266171).
  • CVE-2026-33814: Update golang.org/x/net dependency (bsc#1265762).
  • CVE-2026-41506: Update github.com/go-git/go-git/v5 dependency (bsc#1264923).
  • CVE-2026-34986: Update github.com/go-jose/go-jose/v4 dependency (bsc#1262926).

Other bugfixes:

  • Re-enable binary stripping and debuginfo (bsc#1210938).
Record
SUSE-SU-2026:2665-1
Updated
2026-11-02
OSVSUSE-SU-2026:3056-1 No score

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

  • CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
  • CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
  • CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
  • CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
  • CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
  • CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
  • CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
  • CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
  • CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
  • CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
  • CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
  • CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
  • CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…
Record
SUSE-SU-2026:3056-1
Updated
2026-11-02
OSVSUSE-SU-2026:4210-1 No score

Security update for alloy

This update for alloy fixes the following issues:

  • CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265542).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264949).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263324).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263289).

Changes for alloy:

  • Update to version 1.18.0:
  • BREAKING: otelcol HTTP receivers default to idle_timeout='1m', read_header_timeout='1m', write_timeout='30s' to match upstream. Affects otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and jaeger_remote_sampling.
  • Back off usage reporting on persistent failure
  • Fix Beyla glob parsing
  • Bump github.com/prometheus/procfs for XFS Collector fix
  • database_observability.mysql: Simplify denylist in-memory map
  • database_observability.postgres: Handle DSN with unix sockets
  • database_observability.postgres: Update collect intervals
  • database_observability: Explain-plan conditions now redact
  • Don't emit error log when remotecfg is unused
  • For a full list of changes, please refer to the CHANGELOG: https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md
Record
SUSE-SU-2026:4210-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/go-git/go-git/v5
Go
 through 5.17.2
5.18.0
github.com/go-git/go-git/v6
Go
 through 6.0.0-alpha.1
6.0.0-alpha.2
golang-github-go-git-go-git
Debian:12
 All versions, plus listed versions
5.11.0-15.11.0-25.11.0-35.11.0-45.12.0-1
Show 9 moreShow less
5.13.2-15.14.0-15.16.2-15.17.0-15.17.1-15.19.1-15.19.2-15.4.2-35.4.2-4
 None known
golang-github-go-git-go-git
Debian:13
 All versions, plus listed versions
5.14.0-15.16.2-15.17.0-15.17.1-15.19.1-15.19.2-1
 None known
golang-github-go-git-go-git
Debian:14
 before 5.19.1-1, plus listed versions
5.14.0-15.16.2-15.17.0-15.17.1-1
5.19.1-1
golang-github-go-git-go-git-v6
Debian:14
 before 6.0.0~alpha4-1, plus listed versions
6~git20260305.2083cf94-16~git20260305.2083cf94-26~git20260305.2083cf94-3
6.0.0~alpha4-1
github.com/go-git/go-git/v5
Go
 before 5.18.0
5.18.0
github.com/go-git/go-git/v6
Go
 before 6.0.0-alpha.2
6.0.0-alpha.2
syft
Red Hat:hummingbird:1
 before 0:1.44.0-0.3.hum1
0:1.44.0-0.3.hum1
trivy
Red Hat:hummingbird:1
 before 0:0.72.0-0.1.hum1
0:0.72.0-0.1.hum1
Show 52 moreShow less
Affected packages
PackageAffectedFixed
amazon-ssm-agent
SUSE:Linux Enterprise Server 16.0
 before 3.3.4624.0-160000.1.1
3.3.4624.0-160000.1.1
amazon-ssm-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.3.4624.0-160000.1.1
3.3.4624.0-160000.1.1
google-osconfig-agent
SUSE:Linux Micro 6.0
 before 20260615.01-1.1
20260615.01-1.1
google-osconfig-agent
SUSE:Linux Micro 6.1
 before 20260615.01-slfo.1.1_1.1
20260615.01-slfo.1.1_1.1
google-osconfig-agent
SUSE:Linux Enterprise Server 16.0
 before 20260615.01-160000.1.2
20260615.01-160000.1.2
google-osconfig-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 20260615.01-160000.1.2
20260615.01-160000.1.2
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
alloy
SUSE:Linux Enterprise Server 16.0
 before 1.18.0-160000.1.1
1.18.0-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.18.0-160000.1.1
1.18.0-160000.1.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 3.3.4624.0-150000.5.37.1
3.3.4624.0-150000.5.37.1
amazon-ssm-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 3.3.4624.0-4.49.1
3.3.4624.0-4.49.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 20260615.01-1.47.1
20260615.01-1.47.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.18.0-150700.15.26.1
1.18.0-150700.15.26.1
golang-github-go-git-go-git
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.4.2-35.4.2-3ubuntu0.1~esm15.4.2-3ubuntu0.1~esm2
 None known
golang-github-go-git-go-git
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.4.2-3build15.4.2-45.4.2-4ubuntu0.24.04.15.4.2-4ubuntu0.24.04.25.4.2-4ubuntu0.24.04.2+esm1
Show 4 moreShow less
5.4.2-4ubuntu0.24.04.35.4.2-4ubuntu0.24.04.3+esm15.4.2-4ubuntu0.24.04.3+esm25.4.2-4ubuntu0.24.04.3+esm3
 None known
golang-github-go-git-go-git
Ubuntu:25.10
 All versions, plus listed versions
5.14.0-1
 None known
golang-github-go-git-go-git
Ubuntu:26.10
 All versions, plus listed versions
5.16.2-15.19.1-15.19.2-1
 None known
golang-github-go-git-go-git
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.14.0-15.16.2-15.16.2-1ubuntu0.1~esm1
 None known
amazon-ssm-agent
openSUSE:Tumbleweed
 before 3.3.4268.0-2.1
3.3.4268.0-2.1
google-osconfig-agent
openSUSE:Tumbleweed
 before 20260511.00-1.1
20260511.00-1.1
git-bug
openSUSE:Tumbleweed
 before 0.10.1-4.1
0.10.1-4.1
trivy
openSUSE:Tumbleweed
 before 0.70.0-2.1
0.70.0-2.1
cheat
openSUSE:Tumbleweed
 before 5.1.0-2.1
5.1.0-2.1
alloy
openSUSE:Tumbleweed
 before 1.18.0-1.1
1.18.0-1.1
amazon-ssm-agent
openSUSE:Leap 16.0
 before 3.3.4624.0-160000.1.1
3.3.4624.0-160000.1.1
google-osconfig-agent
openSUSE:Leap 16.0
 before 20260615.01-160000.1.2
20260615.01-160000.1.2
govulncheck-vulndb
openSUSE:Leap 16.0
 before 0.0.20260727T201416-160000.1.1
0.0.20260727T201416-160000.1.1
alloy
openSUSE:Leap 16.0
 before 1.18.0-160000.1.1
1.18.0-160000.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41506 is a medium vulnerability (CVSS 4.7) in Go-git, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in github.com/go-git/go-git/v5 5.18.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 80 references and the rest of 12 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open