CVE-2026-41676

Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.

These are all security issues fixed in the clamav-1.5.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sdbootutil-1+git20260706.f9f4faf-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.28.2~0-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sccache-0.16.0~0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-c-0.10.23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the keylime-ima-policy-0.2.9+49-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-maturin-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-1.1 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

Update to version 1.5.3.

Security issues fixed:

• CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning (bsc#1270107).
• CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning (bsc#1270085).
• CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning (bsc#1270088).
• CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning (bsc#1270089).
• CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning (bsc#1270091).
• CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning (bsc#1270092).
• CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning (bsc#1270106).
• CVE-2026-41676: buffer overflow due to missing checks via Deriver:derive, PkeyCtxRef:derive and OpenSSL 1.1.1 (bsc#1270138).

Other updates and bugfixes:

• Version 1.5.3:

• Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner.
• Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE file and lead to a heap buffer overflow write.
• Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and exhaust temporary storage.
• Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.
• Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip expected scan-limit handling.
• Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them while reading a malformed archive.
• Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit scanner builds.
• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
• Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to resolve CVE-2026-41676.
• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
• Metadata preclass scans now run before the final scan verdict.
• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for libkrun fixes the following issues:

• CVE-2025-24898: openssl: use-after-free in ssl::select_next_proto due to improper lifetime handling (bsc#1270429).
• CVE-2026-41676: openssl: short buffer overflow via Deriver:derive and PkeyCtxRef:derive when using OpenSSL 1.1.1 (bsc#1270198).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270582).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270683).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270721).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270831).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270470).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270877).

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257933).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270202).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.5.0

This update for sdbootutil fixes the following issues:

Security issues fixed:

• CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192).
• CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270616).
• CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
• CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742).
• CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863).
• CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471).
• CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922).
• CVE-2026-45784: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995).

Non security issues fixed:

• sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384).
• systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
• Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

Changes for sdbootutil:

• Update to version 1+git20260908.c641fc2:

• Update the shim when required
• Warn when recovery PIN is different from recovery key
• Improves extra boot entries support
• Better report when the default snapshot diverges
• Explain how to do re-enrolling if recovery PIN fails
• Explain why update-prediction fails and how to solve it
• Hide comparison output
• Add bootctl default entry in the prediction

• Update to version 1+git20260903.f91f636:

• Include FIDO2 unlocked devices for ordering (bsc#1234010)
• Test in parallel for speed up
• Add --repair parameter to cleanup
• Fix shellcheck complain
• Report entries with missing files
• Avoid duplicate entries in non-snapper systems
• Add initial tests for sdbootutil
• Report the error if bootctl clean fails

• Update to version 1+git20260901.41540d5:

• No warn if a component is not in the event log
• Add status command
• Select the new sdbootutil if available
• Skip blank lines in measure-pcr-generator.sh
• Do not change crypttab for unrelated entries
• Report the bad PCR when update-prediction fail
• Do not write the recovery PIN in the journal
• Improves non snapshot system support
• Update help message for --measure-pcr
• Report when PCR 7 is dropped because shim update
• Add --strict parameter for --pcr policy
• Report dropped PCRs via a warn
• Adjust the limits for PolicyOR issues
• Avoid update predictions if the service is up
• Keep the exit status of sdbootutil call

• Update to version 1+git20260827.786f9a8:

• Do not accept empty passwords
• jeos-firstboot-enroll: report errors also in the journal
• Restore old crypttab via the exit trap
• Update CLAUDE data
• Detect half created openssl keys
• check_enrolled report when something was written in the LUKS2 header
• Improve a bit the disk-encryption-tool keyslot detection
• Avoid leak of env var secrets
• Wipe the d-e-t key in the enroll service and jeos module
• Remove the correct keyslot left by d-e-t
• Differentiate tpm2 and tpm2+pin for unattended unlock
• Use is_same_device in detect_tracked_device and drop greps
• Refactor check to avoid shellcheck complain
• Parse the entry file in a sigle place
• Validate the entry with the new kernel name
• Refactor enrollment interface and deprecate the old one
• New kernels will have different hash
• Warn If no crypttab entry found
• Extend is_same_device
• jeos-firstboot-enroll: validate the passwords
• sdbootutil-enroll: report when no encryption method is provided
• Write recovery pin after enrollment in…

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

Deriver::derive and PkeyCtxRef::derive pass the length of the caller's buffer to EVP_PKEY_derive and rely on OpenSSL to write no more than that. With OpenSSL 1.1.x, the X25519, X448 and HKDF-extract implementations ignore the length they are given and always write the whole result, so a buffer shorter than the shared secret or derived key is overrun. The overflow is reachable from safe code.

OpenSSL 3.x checks the length itself and is not affected. From 0.10.78, when built against OpenSSL 1.1.x or LibreSSL, both functions derive into a temporary buffer of the required size whenever the caller's buffer is too short, and copy only what fits.

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for clamav fixes the following issues:

Update to version 1.5.3.

Security issues fixed:

• CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning (bsc#1270107).
• CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning (bsc#1270085).
• CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning (bsc#1270088).
• CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning (bsc#1270089).
• CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning (bsc#1270091).
• CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning (bsc#1270092).
• CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning (bsc#1270106).
• CVE-2026-41676: buffer overflow due to missing checks via Deriver:derive, PkeyCtxRef:derive and OpenSSL 1.1.1 (bsc#1270138).

Other updates and bugfixes:

• Version 1.5.3:

• Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner.
• Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE file and lead to a heap buffer overflow write.
• Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and exhaust temporary storage.
• Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.
• Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip expected scan-limit handling.
• Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them while reading a malformed archive.
• Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit scanner builds.
• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
• Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to resolve CVE-2026-41676.
• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
• Metadata preclass scans now run before the final scan verdict.
• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for s390-tools fixes the following issue

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270185).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270620).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270801).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270620).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270801).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270994).

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for s390-tools fixes the following issue

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270185).

This update for afterburn fixes the following issues

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead to DoS (bsc#1196972).
• CVE-2024-12224: idna: privilege escalation due acceptance Punycode labels that do not produce any non-ASCII when decoded (bsc#1243850).
• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch (bsc#1242665).
• CVE-2025-5791: users: root appended to group listings unless the correct listing has exactly 1024 groups (bsc#1244199).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to…

This update for rust-keylime fixes the following issues

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for libkrun fixes the following issues:

• CVE-2025-24898: openssl: select_next_proto use after free in rust-openssl (bsc#1270429).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270198).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270582).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270683).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270721).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270831).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270470).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270877).

Changes for libkrun:

• Update vendored openssl crate to version 0.10.81.

This update for libkrun fixes the following issues:

• CVE-2025-24898: openssl: use-after-free in ssl::select_next_proto due to improper lifetime handling (bsc#1270429).
• CVE-2026-41676: openssl: short buffer overflow via Deriver:derive and PkeyCtxRef:derive when using OpenSSL 1.1.1 (bsc#1270198).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270582).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270683).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270721).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270831).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270470).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270877).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257933).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270202).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.5.0

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257933).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270202).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.5.0

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for cryptsetup, s390-tools fixes the following issue

Security fixes:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270185).

Changes for s390-tools:

• Upgrade s390-tools to version 2.41.0 (jsc#PED-15860)
• Automatically set appropriate MTU for HSCI (bsc#1259314)
  • Changes of existing tools:
  • chreipl: Make --bootparms work for ECKD re-IPL
  • cpacfstats: Add 'unauthorized' state to CPU-MF counters
  • cpictl: Detect RHCOS using VARIANT_ID
  • hsci: Automatically set appropriate MTU for HSCI
  • libutil: Add util_readlink() and util_readlinkat() helpers
  • libutil: Add util_startswith() to util_str
  • libutil: Add utility parsing functions
  • lschp: Add support for structured output (--format)
  • lsreipl: Suppress 'clear' output if not supported
  • pvimg: Add '--format text' support to 'pvimg info'
  • pvimg: Add '--print-schema ' option to 'pvimg info'
  • pvimg: Add '--show-secrets' flag to 'pvimg info'
  • pvimg: Provide improved JSON output to 'pvimg info --format json'
  • pvinfo: Improve User experience on non-SE enabled systems
  • zipl/ngdump: Ensure ext4 file system is used on dump partition
  • zkey: Add support for integrity protected disks using HMAC keys
• Bug Fixes:
  • cpumf/pai: Handle different size of perf_event_attr
  • lscss: Fix memory leak
  • zipl: Fix dump job on tape devices --- s390-tools 2.40 includes ---
• Add new tools / libraries:
  • Add project-wide .clang-tidy configuration
  • libutil: Introduce util_time for time related functionality
  • libutil: Introduce zsh/bash autocompletion tooling based on util_opt
  • pvinfo: Tool to display Secure Execution system information
  • pvverify: Tool to verify host-key documents
• Changes of existing tools:
  • cpumf: Implement zsh and bash autocompletion
  • dasdfmt: Implement zsh and bash autocompletion
  • dbginfo.sh: Add NetworkManager and netplan
  • dbginfo.sh: Add kvm_stat
  • dbginfo.sh: Adding stp time information
  • dbginfo.sh: Simplify procfs collection
  • hyptop: Add physical information row
  • hyptop: Calculate sample time delta for physical partition
  • hyptop: Replace long option names using _ with - for consistency For example: --cpu_types > --cpu-types (Options with _ are still supported for backward compatibility)
  • libekmfweb: Add function to validate a certificate against the identity key
  • netboot: Add longer kernel command lines support
  • udev/rules.d: Make virtio-blk devices non-rotational
  • udev/rules.d: Set default io scheduler to 'none' for virtio-blk
  • ziomon: Add support to sample device symlinks (/dev/disk/...)
  • ziorep_config: Add fcp-lun details to -M option output
  • ziorep_config: Add port_id and failed attributes to -A option output
  • netboot: Install on non-s390 architectures
• Bug Fixes:
  • lib(ekmfweb|kmipclient): Use ln without -r
  • s390-tools: Fix various compilation issues with musl libc
  • zipl/boot: Fix unused loadparm when SCLP line-mode console is absent --- s390-tools 2.39 includes ---
• Changes of existing tools:
  • chpstat: Add options to select IEC units for scaling (SI units are default)
  • chzdev: Introduce --no-module-load option
  • cpi: Disable CPI for SEL guests by default
  • dbginfo.sh: Enhance logging on timeout triggered
  • iucvterm: Install symlink for lsiucvallow.8 man page
  • lshwc: Add command line flag to specify individual counters
  • lspai: Add command line flag for delta values
  • lspai: Add command line flag for short counter names
  • lspai: Add command line flag to specify individual counters
  • lspai: Add command line flags for all cpus
  • lspai: Add command line flags for hexadecimal output
  • man: Use CR for constant width font
  • pvimg: Add '--image-key' option
  • zdev: Allow dynamic control of module load
  • zipl/boot: Fix EBCDIC code page 500 conversion and decrease size by 200 bytes
  • zipl: Add support of heterogeneous mirrors (remove…

This update for rust-keylime fixes the following issues

• Update to version 0.2.9+49
• Update openssl to 0.10.81
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).

This update for rust-keylime fixes the following issues

• Update to version 0.2.9+49
• Update openssl to 0.10.81
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).