{"id":"CVE-2023-45142","aliases":["AZL-31303","AZL-33347","AZL-33516","AZL-34580","AZL-34889","AZL-34900","AZL-35069","AZL-35116","AZL-35119","AZL-35437","AZL-39972","EUVD-2023-2802","GHSA-rcjv-mgp8-qvmr","GO-2023-2113","RHSA-2024:4118","SUSE-SU-2024:3188-1","SUSE-SU-2024:3221-1","SUSE-SU-2024:3266-1","SUSE-SU-2024:3267-1","SUSE-SU-2024:3288-1","SUSE-SU-2024:4319-1","SUSE-SU-2024:4360-1","SUSE-SU-2025:20091-1","SUSE-SU-2025:20110-1","SUSE-SU-2025:20259-1","UBUNTU-CVE-2023-45142","openSUSE-SU-2024:0211-1","openSUSE-SU-2024:0220-1","openSUSE-SU-2024:13360-1","openSUSE-SU-2024:13495-1","openSUSE-SU-2024:14232-1","openSUSE-SU-2024:14320-1","openSUSE-SU-2024:14321-1"],"status":"published","title":"OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01614,"percentile":0.76147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2023-10-12T16:33:21Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace","fixed_in":["0.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"cri-tools","fixed_in":["1.29.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-compose","fixed_in":["2.17.3-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"opa","fixed_in":["0.63.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.12-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","fixed_in":["0.0.10-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.29.1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"opa","fixed_in":["0.63.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus","fixed_in":["2.45.4-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus-adapter","fixed_in":["0.12.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-buildx","fixed_in":["0.14.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-engine","fixed_in":["24.0.9-10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"caddy","fixed_in":["2.7.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"golang-github-prometheus-prometheus","fixed_in":["2.53.0-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.12-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.63.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9-10"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-immutable-object-cache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-cephadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-prometheus-alerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"cephadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"cephfs-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libcephsqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libcephsqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-immutable-object-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-mib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"cephfs-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"cephfs-top","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-immutable-object-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-immutable-object-cache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-mib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"cephadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"cephfs-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"cephfs-top","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libcephsqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el9","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.2.10-266.el9cp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:5.3::el8","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.28.8-1.el8cp"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-16.94.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-1.53.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-21.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9-38.147.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.21-1.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-150000.3.56.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-150000.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9-150000.3.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.21-150000.1.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.21-150000.1.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9-150000.3.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9-150000.3.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-150100.4.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-150100.4.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-150100.4.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-150100.4.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.6-150100.4.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-98.120.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-98.120.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-150000.212.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-opentelemetry-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.56.0-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-opentelemetry-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.56.0-5","1.43.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-opentelemetry-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.56.0-5"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-bp155.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-bp155.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-bp156.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-bp156.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"caddy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.5_ce-2.1"}]}],"bundled":2}],"products":[{"vendor":"open-telemetry","product":"opentelemetry-go-contrib"},{"vendor":"opentelemetry","product":"opentelemetry"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","web"]},{"url":"https://github.com/advisories/GHSA-cg3q-j54f-5p7p","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45142","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rcjv-mgp8-qvmr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45142.json","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4118","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39325","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45142","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2281592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2291136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292327","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4118.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://go.dev/issue/63417","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45142","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49569","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243188-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1217952","tags":["report"]},{"url":"https://bugzilla.suse.com/1221400","tags":["report"]},{"url":"https://bugzilla.suse.com/1224323","tags":["report"]},{"url":"https://bugzilla.suse.com/1228553","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243221-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200528","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243266-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220136","tags":["report"]},{"url":"https://bugzilla.suse.com/1224349","tags":["report"]},{"url":"https://bugzilla.suse.com/1225349","tags":["report"]},{"url":"https://bugzilla.suse.com/1226191","tags":["report"]},{"url":"https://bugzilla.suse.com/1226284","tags":["report"]},{"url":"https://bugzilla.suse.com/1226437","tags":["report"]},{"url":"https://bugzilla.suse.com/1226759","tags":["report"]},{"url":"https://bugzilla.suse.com/1226793","tags":["report"]},{"url":"https://bugzilla.suse.com/1226847","tags":["report"]},{"url":"https://bugzilla.suse.com/1226914","tags":["report"]},{"url":"https://bugzilla.suse.com/1227038","tags":["report"]},{"url":"https://bugzilla.suse.com/1227195","tags":["report"]},{"url":"https://bugzilla.suse.com/1227244","tags":["report"]},{"url":"https://bugzilla.suse.com/1227245","tags":["report"]},{"url":"https://bugzilla.suse.com/1227505","tags":["report"]},{"url":"https://bugzilla.suse.com/1227584","tags":["report"]},{"url":"https://bugzilla.suse.com/1227586","tags":["report"]},{"url":"https://bugzilla.suse.com/1227588","tags":["report"]},{"url":"https://bugzilla.suse.com/1227718","tags":["report"]},{"url":"https://bugzilla.suse.com/1227951","tags":["report"]},{"url":"https://bugzilla.suse.com/1228026","tags":["report"]},{"url":"https://bugzilla.suse.com/1228183","tags":["report"]},{"url":"https://bugzilla.suse.com/1228198","tags":["report"]},{"url":"https://bugzilla.suse.com/1228556","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243267-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243288-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204023","tags":["report"]},{"url":"https://bugzilla.suse.com/1208298","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244319-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228324","tags":["report"]},{"url":"https://bugzilla.suse.com/1229806","tags":["report"]},{"url":"https://bugzilla.suse.com/1230294","tags":["report"]},{"url":"https://bugzilla.suse.com/1230331","tags":["report"]},{"url":"https://bugzilla.suse.com/1230333","tags":["report"]},{"url":"https://bugzilla.suse.com/1231348","tags":["report"]},{"url":"https://bugzilla.suse.com/1232999","tags":["report"]},{"url":"https://bugzilla.suse.com/1233819","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244360-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520091-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520110-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223409","tags":["report"]},{"url":"https://bugzilla.suse.com/1234089","tags":["report"]},{"url":"https://bugzilla.suse.com/1237335","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29018","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-45142","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4POHOO6U2FW5XKZT7HPGZAJF7LQQW3W4/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222468","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22189","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QNDMJCVODSMOIFD655EHBVQRLNUDXLQK/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45133","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45142","title":"OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T16:33:21.435Z","modified":"2025-02-13T17:13:49.6Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-2802","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T16:33:21Z","modified":"2025-02-13T17:13:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-rcjv-mgp8-qvmr","title":"OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics","description":"### Summary\n\nThis handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65\nout of the box adds labels\n\n- `http.user_agent`\n- `http.method`\n\nthat have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it.\n\n### Details\n\nHTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses [httpconv.ServerRequest](https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159) that records every value for HTTP [method](https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L204) and [User-Agent](https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223).\n\n### PoC\n\nSend many requests with long randomly generated HTTP methods or/and User agents (e.g. a million) and observe how memory consumption increases during it.\n\n### Impact\n\nIn order to be affected, the program has to configure a metrics pipeline, use [otelhttp.NewHandler](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65) wrapper, and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc.\n\n### Others\n\nIt is similar to already reported vulnerabilities\n- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh ([open-telemetry/opentelemetry-go-contrib](https://github.com/open-telemetry/opentelemetry-go-contrib))\n- https://github.com/advisories/GHSA-cg3q-j54f-5p7p ([prometheus/client_golang](https://github.com/prometheus/client_golang))\n\n### Workaround for affected versions\n\nAs a workaround to stop being affected [otelhttp.WithFilter()](https://pkg.go.dev/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/filters) can be used, but it requires manual careful configuration to not log certain requests entirely.\n\nFor convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.\n\nThe other possibility is to disable HTTP metrics instrumentation by passing [`otelhttp.WithMeterProvider`](https://pkg.go.dev/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp#WithMeterProvider) option with [`noop.NewMeterProvider`](https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider).\n\n### Solution provided by upgrading\n\nIn PR https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277, released with package version 0.44.0, the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed.\n\n### References\n\n- https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277\n- https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0\n","status":"published","published":"2023-10-16T14:01:54Z","modified":"2024-02-19T03:30:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2023-45142","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09.99Z","modified":"2026-06-17T06:28:18.303Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:08:37.83429Z"}],"osv":[{"id":"AZL-31303","title":"CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:26:13.882491Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-33347","title":"CVE-2023-45142 affecting package moby-compose for versions less than 2.17.3-7","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:26:48.977Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-33516","title":"CVE-2023-45142 affecting package opa for versions less than 0.63.0-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:26:51.552675Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34580","title":"CVE-2023-45142 affecting package cert-manager for versions less than 1.12.12-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:34:20.173013Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34889","title":"CVE-2023-45142 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:51:44.096758Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34900","title":"CVE-2023-45142 affecting package kubernetes for versions less than 1.29.1-2","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:33:35.79627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35069","title":"CVE-2023-45142 affecting package opa for versions less than 0.63.0-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:49:51.42975Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35116","title":"CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:53:16.904594Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35119","title":"CVE-2023-45142 affecting package prometheus-adapter for versions less than 0.12.0-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:50:39.702066Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35437","title":"CVE-2023-45142 affecting package docker-buildx for versions less than 0.14.0-1","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:32:15.39115Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-39972","title":"CVE-2023-45142 affecting package moby-engine for versions less than 24.0.9-10","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:09Z","modified":"2026-04-21T04:28:52.852735Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CVE-2023-45142","title":"OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T16:33:21.435Z","modified":"2026-10-28T02:30:28.112085784Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-rcjv-mgp8-qvmr","title":"OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics","description":"### Summary\n\nThis handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65\nout of the box adds labels\n\n- `http.user_agent`\n- `http.method`\n\nthat have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it.\n\n### Details\n\nHTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses [httpconv.ServerRequest](https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159) that records every value for HTTP [method](https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L204) and [User-Agent](https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223).\n\n### PoC\n\nSend many requests with long randomly generated HTTP methods or/and User agents (e.g. a million) and observe how memory consumption increases during it.\n\n### Impact\n\nIn order to be affected, the program has to configure a metrics pipeline, use [otelhttp.NewHandler](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65) wrapper, and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc.\n\n### Others\n\nIt is similar to already reported vulnerabilities\n- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh ([open-telemetry/opentelemetry-go-contrib](https://github.com/open-telemetry/opentelemetry-go-contrib))\n- https://github.com/advisories/GHSA-cg3q-j54f-5p7p ([prometheus/client_golang](https://github.com/prometheus/client_golang))\n\n### Workaround for affected versions\n\nAs a workaround to stop being affected [otelhttp.WithFilter()](https://pkg.go.dev/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/filters) can be used, but it requires manual careful configuration to not log certain requests entirely.\n\nFor convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.\n\nThe other possibility is to disable HTTP metrics instrumentation by passing [`otelhttp.WithMeterProvider`](https://pkg.go.dev/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp#WithMeterProvider) option with [`noop.NewMeterProvider`](https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider).\n\n### Solution provided by upgrading\n\nIn PR https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277, released with package version 0.44.0, the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed.\n\n### References\n\n- https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277\n- https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0\n","status":"published","published":"2023-10-16T14:01:54Z","modified":"2026-09-10T03:49:24.6626561Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"RHSA-2024:4118","title":"Red Hat Security Advisory: Red Hat Ceph Storage 5.3 security, bug fix, and enhancement update","status":"published","published":"2024-10-01T23:42:33Z","modified":"2026-10-20T10:02:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2023-45142","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.","status":"published","published":"2023-10-12T17:15:00Z","modified":"2026-10-17T12:56:25.903634759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"GO-2023-2113","title":"Memory exhaustion in go.opentelemetry.io/contrib/instrumentation","description":"Memory exhaustion in go.opentelemetry.io/contrib/instrumentation","status":"published","published":"2023-10-16T19:30:55Z","modified":"2026-02-04T04:22:57.633411Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:0211-1","title":"Security update for caddy","description":"This update for caddy fixes the following issues:\n\nUpdate to version 2.8.4:\n\n  * cmd: fix regression in auto-detect of Caddyfile (#6362)\n  * Tag v2.8.3 was mistakenly made on the v2.8.2 commit and is skipped\n\nUpdate to version 2.8.2:\n\n  * cmd: fix auto-detetction of .caddyfile extension (#6356)\n  * caddyhttp: properly sanitize requests for root path (#6360)\n  * caddytls: Implement certmagic.RenewalInfoGetter\n\nUpdate to version 2.8.1:\n\n  * caddyhttp: Fix merging consecutive `client_ip` or `remote_ip` matchers (#6350)\n  * core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)\n\nUpdate to version 2.8.0:\n\n  * acmeserver: Add `sign_with_root` for Caddyfile (#6345)\n  * caddyfile: Reject global request matchers earlier (#6339)\n  * core: Fix bug in AppIfConfigured (fix #6336)\n  * fix a typo (#6333)\n  * autohttps: Move log WARN to INFO, reduce confusion (#6185)\n  * reverseproxy: Support HTTP/3 transport to backend (#6312)\n  * context: AppIfConfigured returns error; consider not-yet-provisioned modules (#6292)\n  * Fix lint error about deprecated method in smallstep/certificates/authority\n  * go.mod: Upgrade dependencies\n  * caddytls: fix permission requirement with AutomationPolicy (#6328)\n  * caddytls: remove ClientHelloSNICtxKey (#6326)\n  * caddyhttp: Trace individual middleware handlers (#6313)\n  * templates: Add `pathEscape` template function and use it in file browser (#6278)\n  * caddytls: set server name in context (#6324)\n  * chore: downgrade minimum Go version in go.mod (#6318)\n  * caddytest: normalize the JSON config (#6316)\n  * caddyhttp: New experimental handler for intercepting responses (#6232)\n  * httpcaddyfile: Set challenge ports when http_port or https_port are used\n  * logging: Add support for additional logger filters other than hostname (#6082)\n  * caddyhttp: Log 4xx as INFO; 5xx as ERROR (close #6106)\n  * caddyhttp: Alter log message when request is unhandled (close #5182)\n  * reverseproxy: Pointer to struct when loading modules; remove LazyCertPool (#6307)\n  * tracing: add trace_id var (`http.vars.trace_id` placeholder) (#6308)\n  * go.mod: CertMagic v0.21.0\n  * reverseproxy: Implement health_follow_redirects (#6302)\n  * caddypki: Allow use of root CA without a key. Fixes #6290 (#6298)\n  * go.mod: Upgrade to quic-go v0.43.1\n  * reverseproxy: HTTP transport: fix PROXY protocol initialization (#6301)\n  * caddytls: Ability to drop connections (close #6294)\n  * httpcaddyfile: Fix expression matcher shortcut in snippets (#6288)\n  * caddytls: Evict internal certs from cache based on issuer (#6266)\n  * chore: add warn logs when using deprecated fields (#6276)\n  * caddyhttp: Fix linter warning about deprecation\n  * go.mod: Upgrade to quic-go v0.43.0\n  * fileserver: Set 'Vary: Accept-Encoding' header (see #5849)\n  * events: Add debug log\n  * reverseproxy: handle buffered data during hijack (#6274)\n  * ci: remove `android` and `plan9` from cross-build workflow (#6268)\n  * run `golangci-lint run --fix --fast` (#6270)\n  * caddytls: Option to configure certificate lifetime (#6253)\n  * replacer: Implement `file.*` global replacements (#5463)\n  * caddyhttp: Address some Go 1.20 features (#6252)\n  * Quell linter (false positive)\n  * reverse_proxy: Add grace_period for SRV upstreams to Caddyfile (#6264)\n  * doc: add `verifier` in `ClientAuthentication` caddyfile marshaler doc (#6263)\n  * caddytls: Add Caddyfile support for on-demand permission module (close #6260)\n  * reverseproxy: Remove long-deprecated buffering properties\n  * reverseproxy: Reuse buffered request body even if partially drained\n  * reverseproxy: Accept EOF when buffering\n  * logging: Fix default access logger (#6251)\n  * fileserver: Improve Vary handling (#5849)\n  * cmd: Only validate config is proper JSON if config slice has data (#6250)\n  * staticresp: Use the evaluated response body for sniffing JSON content-type (#6249)\n  * encode: Slight fix for the previous commit\n  * encode: Improve Etag handling (fix #5849)\n  * httpcaddyfile: Skip automate loader if disable_certs is specified (fix #6148)\n  * caddyfile: Populate regexp matcher names by default (#6145)\n  * caddyhttp: record num. bytes read when response writer is hijacked (#6173)\n  * caddyhttp: Support multiple logger names per host (#6088)\n  * chore: fix some typos in comments (#6243)\n  * encode: Configurable compression level for zstd (#6140)\n  * caddytls: Remove shim code supporting deprecated lego-dns (#6231)\n  * connection policy: add `local_ip`  matcher (#6074)\n  * reverseproxy: Wait for both ends of websocket to close (#6175)\n  * caddytls: Upgrade ACMEz to v2; support ZeroSSL API; various fixes (#6229)\n  * caddytls: Still provision permission module if ask is specified\n  * fileserver: read etags from precomputed files (#6222)\n  * fileserver: Escape # and ? in img src (fix #6237)\n  * reverseproxy: Implement modular CA provider for TLS transport (#6065)\n  * caddyhttp: Apply auto HTTPS redir to all interfaces (fix #6226)\n  * cmd: Fix panic related to config filename (fix #5919)\n  * cmd: Assume Caddyfile based on filename prefix and suffix (#5919)\n  * admin: Make `Etag` a header, not a trailer (#6208)\n  * caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234)\n  * caddyconfig: Use empty struct instead of bool in map (close #6224) (#6227)\n  * gitignore: Add rule for caddyfile.go (#6225)\n  * chore: Fix broken links in README.md (#6223)\n  * chore: Upgrade some dependencies (#6221)\n  * caddyhttp: Add plaintext response to `file_server browse` (#6093)\n  * admin: Use xxhash for etag (#6207)\n  * modules: fix some typo in conments (#6206)\n  * caddyhttp: Replace sensitive headers with REDACTED (close #5669)\n  * caddyhttp: close quic connections when server closes (#6202)\n  * reverseproxy: Use xxhash instead of fnv32 for LB (#6203)\n  * caddyhttp: add http.request.local{,.host,.port} placeholder (#6182)\n  * chore: remove repetitive word (#6193)\n  * Added a null check to avoid segfault on rewrite query ops (#6191)\n  * rewrite: `uri query` replace operation (#6165)\n  * logging: support `ms` duration format and add docs (#6187)\n  * replacer: use RWMutex to protect static provider (#6184)\n  * caddyhttp: Allow `header` replacement with empty string (#6163)\n  * vars: Make nil values act as empty string instead of `'\u003cnil\u003e'` (#6174)\n  * chore: Update quic-go to v0.42.0 (#6176)\n  * caddyhttp: Accept XFF header values with ports, when parsing client IP (#6183)\n  * reverseproxy: configurable active health_passes and health_fails (#6154)\n  * reverseproxy: Configurable forward proxy URL (#6114)\n  * caddyhttp: upgrade to cel v0.20.0 (#6161)\n  * chore: Bump Chroma to v2.13.0, includes new Caddyfile lexer (#6169)\n  * caddyhttp: suppress flushing if the response is being buffered (#6150)\n  * chore: encode: use FlushError instead of Flush (#6168)\n  * encode: write status immediately when status code is informational (#6164)\n  * httpcaddyfile: Keep deprecated `skip_log` in directive order (#6153)\n  * httpcaddyfile: Add `RegisterDirectiveOrder` function for plugin authors (#5865)\n  * rewrite: Implement `uri query` operations (#6120)\n  * fix struct names (#6151)\n  * fileserver: Preserve query during canonicalization redirect (#6109)\n  * logging: Implement `log_append` handler (#6066)\n  * httpcaddyfile: Allow nameless regexp placeholder shorthand (#6113)\n  * logging: Implement `append` encoder, allow flatter filters config (#6069)\n  * ci: fix the integration test `TestLeafCertLoaders` (#6149)\n  * vars: Allow overriding `http.auth.user.id` in replacer as a special case (#6108)\n  * caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)\n  * cmd: Adjust config load logs/errors (#6032)\n  * reverseproxy: SRV dynamic upstream failover (#5832)\n  * ci: bump golangci/golangci-lint-action from 3 to 4 (#6141)\n  * core: OnExit hooks (#6128)\n  * cmd: fix the output of the `Usage` section (#6138)\n  * caddytls: verifier: caddyfile: re-add Caddyfile support (#6127)\n  * acmeserver: add policy field to define allow/deny rules (#5796)\n  * reverseproxy: cookie should be Secure and SameSite=None when TLS (#6115)\n  * caddytest: Rename adapt tests to `*.caddyfiletest` extension (#6119)\n  * tests: uses testing.TB interface for helper to be able to use test server in benchmarks. (#6103)\n  * caddyfile: Assert having a space after heredoc marker to simply check (#6117)\n  * chore: Update Chroma to get the new Caddyfile lexer (#6118)\n  * reverseproxy: use context.WithoutCancel (#6116)\n  * caddyfile: Reject directives in the place of site addresses (#6104)\n  * caddyhttp: Register post-shutdown callbacks (#5948)\n  * caddyhttp: Only attempt to enable full duplex for HTTP/1.x (#6102)\n  * caddyauth: Drop support for `scrypt` (#6091)\n  * Revert 'caddyfile: Reject long heredoc markers (#6098)' (#6100)\n  * caddyauth: Rename `basicauth` to `basic_auth` (#6092)\n  * logging: Inline Caddyfile syntax for `ip_mask` filter (#6094)\n  * caddyfile: Reject long heredoc markers (#6098)\n  * chore: Rename CI jobs, run on M1 mac (#6089)\n  * fix: add back text/*\n  * fix: add more media types to the compressed by default list\n  * acmeserver: support specifying the allowed challenge types (#5794)\n  * matchers: Drop `forwarded` option from `remote_ip` matcher (#6085)\n  * caddyhttp: Test cases for `%2F` and `%252F` (#6084)\n  * fileserver: Browse can show symlink target if enabled (#5973)\n  * core: Support NO_COLOR env var to disable log coloring (#6078)\n  * Update comment in setcap helper script\n  * caddytls: Make on-demand 'ask' permission modular (#6055)\n  * core: Add `ctx.Slogger()` which returns an `slog` logger (#5945)\n  * chore: Update quic-go to v0.41.0, bump Go minimum to 1.21 (#6043)\n  * chore: enabling a few more linters (#5961)\n  * caddyfile: Correctly close the heredoc when the closing marker appears immediately (#6062)\n  * caddyfile: Switch to slices.Equal for better performance (#6061)\n  * tls: modularize trusted CA providers (#5784)\n  * logging: Automatic `wrap` default for `filter` encoder (#5980)\n  * caddyhttp: Fix panic when request missing ClientIPVarKey (#6040)\n  * caddyfile: Normalize \u0026 flatten all unmarshalers (#6037)\n  * cmd: reverseproxy: log: use caddy logger (#6042)\n  * matchers: `query` now ANDs multiple keys (#6054)\n  * caddyfile: Add heredoc support to `fmt` command (#6056)\n  * refactor: move automaxprocs init in caddycmd.Main()\n  * caddyfile: Allow heredoc blank lines (#6051)\n  * httpcaddyfile: Add optional status code argument to `handle_errors` directive (#5965)\n  * httpcaddyfile: Rewrite `root` and `rewrite` parsing to allow omitting matcher (#5844)\n  * fileserver: Implement caddyfile.Unmarshaler interface (#5850)\n  * reverseproxy: Add `tls_curves` option to HTTP transport (#5851)\n  * caddyhttp: Security enhancements for client IP parsing (#5805)\n  * replacer: Fix escaped closing braces (#5995)\n  * filesystem: Globally declared filesystems, `fs` directive (#5833)\n  * ci/cd: use the build tag `nobadger` to exclude badgerdb (#6031)\n  * httpcaddyfile: Fix redir \u003cto\u003e html (#6001)\n  * httpcaddyfile: Support client auth verifiers (#6022)\n  * tls: add reuse_private_keys (#6025)\n  * reverseproxy: Only change Content-Length when full request is buffered (#5830)\n  * Switch Solaris-derivatives away from listen_unix (#6021)\n  * chore: check against errors of `io/fs` instead of `os` (#6011)\n  * caddyhttp: support unix sockets in `caddy respond` command (#6010)\n  * fileserver: Add total file size to directory listing (#6003)\n  * httpcaddyfile: Fix cert file decoding to load multiple PEM in one file (#5997)\n  * cmd: use automaxprocs for better perf in containers (#5711)\n  * logging: Add `zap.Option` support (#5944)\n  * httpcaddyfile: Sort skip_hosts for deterministic JSON (#5990)\n  * metrics: Record request metrics on HTTP errors (#5979)\n  * go.mod: Updated quic-go to v0.40.1 (#5983)\n  * fileserver: Enable compression for command by default (#5855)\n  * fileserver: New --precompressed flag (#5880)\n  * caddyhttp: Add `uuid` to access logs when used (#5859)\n  * proxyprotocol: use github.com/pires/go-proxyproto (#5915)\n  * cmd: Preserve LastModified date when exporting storage (#5968)\n  * core: Always make AppDataDir for InstanceID (#5976)\n  * chore: cross-build for AIX (#5971)\n  * caddytls: Sync distributed storage cleaning (#5940)\n  * caddytls: Context to DecisionFunc (#5923)\n  * tls: accept placeholders in string values of certificate loaders (#5963)\n  * templates: Offically make templates extensible (#5939)\n  * http2 uses new round-robin scheduler (#5946)\n  * panic when reading from backend failed to propagate stream error (#5952)\n  * chore: Bump otel to v1.21.0. (#5949)\n  * httpredirectlistener: Only set read limit for when request is HTTP (#5917)\n  * fileserver: Add .m4v for browse template icon\n  * Revert 'caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)' (#5924)\n  * go.mod: update quic-go version to v0.40.0 (#5922)\n  * update quic-go to v0.39.3 (#5918)\n  * chore: Fix usage pool comment (#5916)\n  * test: acmeserver: add smoke test for the ACME server directory (#5914)\n  *  Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)\n  * caddyhttp: Adjust `scheme` placeholder docs (#5910)\n  * go.mod: Upgrade quic-go to v0.39.1\n  * go.mod: CVE-2023-45142 Update opentelemetry (#5908)\n  * templates: Delete headers on `httpError` to reset to clean slate (#5905)\n  * httpcaddyfile: Remove port from logger names (#5881)\n  * core: Apply SO_REUSEPORT to UDP sockets (#5725)\n  * caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)\n  * cmd: Add newline character to version string in CLI output (#5895)\n  * core: quic listener will manage the underlying socket by itself (#5749)\n  * templates: Clarify `include` args docs, add `.ClientIP` (#5898)\n  * httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)\n  * cmd: upgrade: resolve symlink of the executable (#5891)\n  * caddyfile: Fix variadic placeholder false positive when token contains `:` (#5883)\n\n- CVEs:\n  * CVE-2024-22189 (boo#1222468)\n  * CVE-2023-45142\n\n- Remove the manual user/group provides: the package uses\n  sysusers.d; the auto-provides were not working due to the broken\n  go_provides.\n\n- Provide user and group (due to RPM 4.19)\n- Update caddy.sysusers to also create a group\n\n- Update to version 2.7.6:\n\n  * caddytls: Sync distributed storage cleaning (#5940)\n  * caddytls: Context to DecisionFunc (#5923)\n  * tls: accept placeholders in string values of certificate loaders (#5963)\n  * templates: Offically make templates extensible (#5939)\n  * http2 uses new round-robin scheduler (#5946)\n  * panic when reading from backend failed to propagate stream error (#5952)\n  * chore: Bump otel to v1.21.0. (#5949)\n  * httpredirectlistener: Only set read limit for when request is HTTP (#5917)\n  * fileserver: Add .m4v for browse template icon\n  * Revert 'caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)' (#5924)\n  * go.mod: update quic-go version to v0.40.0 (#5922)\n  * update quic-go to v0.39.3 (#5918)\n  * chore: Fix usage pool comment (#5916)\n  * test: acmeserver: add smoke test for the ACME server directory (#5914)\n  * Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)\n  * caddyhttp: Adjust `scheme` placeholder docs (#5910)\n  * go.mod: Upgrade quic-go to v0.39.1\n  * go.mod: CVE-2023-45142 Update opentelemetry (#5908)\n  * templates: Delete headers on `httpError` to reset to clean slate (#5905)\n  * httpcaddyfile: Remove port from logger names (#5881)\n  * core: Apply SO_REUSEPORT to UDP sockets (#5725)\n  * caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)\n  * cmd: Add newline character to version string in CLI output (#5895)\n  * core: quic listener will manage the underlying socket by itself (#5749)\n  * templates: Clarify `include` args docs, add `.ClientIP` (#5898)\n  * httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)\n  * cmd: upgrade: resolve symlink of the executable (#5891)\n  * caddyfile: Fix variadic placeholder false positive when token contains `:` (#5883)\n\n- Update to version 2.7.5:\n\n  * admin: Respond with 4xx on non-existing config path (#5870)\n  * ci: Force the Go version for govulncheck (#5879)\n  * fileserver: Set canonical URL on browse template (#5867)\n  * tls: Add X25519Kyber768Draft00 PQ 'curve' behind build tag (#5852)\n  * reverseproxy: Add more debug logs (#5793)\n  * reverseproxy: Fix `least_conn` policy regression (#5862)\n  * reverseproxy: Add logging for dynamic A upstreams (#5857)\n  * reverseproxy: Replace health header placeholders (#5861)\n  * httpcaddyfile: Sort TLS SNI matcher for deterministic JSON output (#5860)\n  * cmd: Fix exiting with custom status code, add `caddy -v` (#5874)\n  * reverseproxy: fix parsing Caddyfile fails for unlimited request/response buffers (#5828)\n  * reverseproxy: Fix retries on 'upstreams unavailable' error (#5841)\n  * httpcaddyfile: Enable TLS for catch-all site if `tls` directive is specified (#5808)\n  * encode: Add `application/wasm*` to the default content types (#5869)\n  * fileserver: Add command shortcuts `-l` and `-a` (#5854)\n  * go.mod: Upgrade dependencies incl. x/net/http\n  * templates: Add dummy `RemoteAddr` to `httpInclude` request, proxy compatibility (#5845)\n  * reverseproxy: Allow fallthrough for response handlers without routes (#5780)\n  * fix: caddytest.AssertResponseCode error message (#5853)\n  * caddyhttp: Use LimitedReader for HTTPRedirectListener\n  * fileserver: browse template SVG icons and UI tweaks (#5812)\n  * reverseproxy: fix nil pointer dereference in AUpstreams.GetUpstreams (#5811)\n  * httpcaddyfile: fix placeholder shorthands in named routes (#5791)\n  * cmd: Prevent overwriting existing env vars with `--envfile` (#5803)\n  * ci: Run govulncheck (#5790)\n  * logging: query filter for array of strings (#5779)\n  * logging: Clone array on log filters, prevent side-effects (#5786)\n  * fileserver: Export BrowseTemplate\n  * ci: ensure short-sha is exported correctly on all platforms (#5781)\n  * caddyfile: Fix case where heredoc marker is empty after newline (#5769)\n  * go.mod: Update quic-go to v0.38.0 (#5772)\n  * chore: Appease gosec linter (#5777)\n  * replacer: change timezone to UTC for 'time.now.http' placeholders (#5774)\n  * caddyfile: Adjust error formatting (#5765)\n  * update quic-go to v0.37.6 (#5767)\n  * httpcaddyfile: Stricter errors for site and upstream address schemes (#5757)\n  * caddyfile: Loosen heredoc parsing (#5761)\n  * fileserver: docs: clarify the ability to produce JSON array with `browse` (#5751)\n  * fix package typo (#5764)\n\n- Switch to sysuser for user setup\n\nUpdate to version 2.7.4:\n\n  * go.mod: Upgrade CertMagic and quic-go\n  * reverseproxy: Always return new upstreams (fix #5736) (#5752)\n  * ci: use gci linter (#5708)\n  * fileserver: Slightly more fitting icons\n  * cmd: Require config for caddy validate (fix #5612) (#5614)\n  * caddytls: Update docs for on-demand config\n  * fileserver: Don't repeat error for invalid method inside error context (#5705)\n  * ci: Update to Go 1.21 (#5719)\n  * ci: Add riscv64 (64-bit RISC-V) to goreleaser (#5720)\n  * go.mod: Upgrade golang.org/x/net to 0.14.0 (#5718)\n  * ci: Use gofumpt to format code (#5707)\n  * templates: Fix httpInclude (fix #5698)\n\nUpdate to version 2.7.3:\n\n  * go.mod: Upgrade to quic-go v0.37.3\n  * cmd: Split unix sockets for admin endpoint addresses (#5696)\n  * reverseproxy: do not parse upstream address too early if it contains replaceble parts (#5695)\n  * caddyfile: check that matched key is not a substring of the replacement key (#5685)\n  * chore: use `--clean` instead of `--rm-dist` for goreleaser (#5691)\n  * go.mod: Upgrade quic-go to v0.37.2 (fix  #5680)\n  * fileserver: browse: Render SVG images in grid\n\n- Update to version 2.7.2:\n  * reverseproxy: Fix hijack ordering which broke websockets (#5679)\n  * httpcaddyfile: Fix `string does not match ~[]E` error (#5675)\n  * encode: Fix infinite recursion (#5672)\n  * caddyhttp: Make use of `http.ResponseController` (#5654)\n  * go.mod: Upgrade dependencies esp. smallstep/certificates\n  * core: Allow loopback hosts for admin endpoint (fix #5650) (#5664)\n  * httpcaddyfile: Allow `hostnames` \u0026 logger name overrides for log directive (#5643)\n  * reverseproxy: Connection termination cleanup (#5663)\n  * go.mod: Use quic-go 0.37.1\n  * reverseproxy: Export ipVersions type (#5648)\n  * go.mod: Use latest CertMagic (v0.19.1)\n  * caddyhttp: Preserve original error (fix #5652)\n  * fileserver: add lazy image loading (#5646)\n  * go.mod: Update quic-go to v0.37.0, bump to Go 1.20 minimum (#5644)\n  * core: Refine mutex during reloads (fix #5628) (#5645)\n  * go.mod: update quic-go to v0.36.2 (#5636)\n  * fileserver: Tweak grid view of browse template\n  * fileserver: add `export-template` sub-command to `file-server` (#5630)\n  * caddyfile: Fix comparing if two tokens are on the same line (#5626)\n  * caddytls: Reuse certificate cache through reloads (#5623)\n  * Minor tweaks to security.md\n  * reverseproxy: Pointer receiver\n  * caddyhttp: Trim dot/space only on Windows (fix #5613)\n  * update quic-go to v0.36.1 (#5611)\n  * caddyconfig: Specify config adapter for HTTP loader (close #5607)\n  * core: Embed net.UDPConn to gain optimizations (#5606)\n  * chore: remove deprecated property `rlcp` in goreleaser config (#5608)\n  * core: Skip `chmod` for abstract unix sockets (#5596)\n  * core: Add optional unix socket file permissions (#4741)\n  * reverseproxy: Honor `tls_except_port` for active health checks (#5591)\n  * Appease linter\n  * Fix compile on Windows, hopefully\n  * core: Properly preserve unix sockets (fix  #5568)\n  * go.mod: Upgrade CertMagic for hotfix\n  * go.mod: Upgrade some dependencies\n  * chore: upgrade otel (#5586)\n  * go.mod: Update quic-go to v0.36.0 (#5584)\n  * reverseproxy: weighted_round_robin load balancing policy (#5579)\n  * reverseproxy: Experimental streaming timeouts (#5567)\n  * chore: remove refs of deprecated io/ioutil (#5576)\n  * headers: Allow `\u003e` to defer shortcut for replacements (#5574)\n  * caddyhttp: Support custom network for HTTP/3 (#5573)\n  * reverseproxy: Fix parsing of source IP in case it's an ipv6 address (#5569)\n  * fileserver: browse: Better grid layout (#5564)\n  * caddytls: Clarify some JSON config docs\n  * cmd: Implement storage import/export (#5532)\n  * go.mod: Upgrade quic-go to 0.35.1\n  * update quic-go to v0.35.0 (#5560)\n  * templates: Add `readFile` action that does not evaluate templates (#5553)\n  * caddyfile: Track import name instead of modifying filename (#5540)\n  * core: Use SO_REUSEPORT_LB on FreeBSD (#5554)\n  * caddyfile: Do not replace import tokens if they are part of a snippet (#5539)\n  * fileserver: Don't set Etag if mtime is 0 or 1 (close #5548) (#5550)\n  * fileserver: browse: minor tweaks for grid view, dark mode (#5545)\n  * fileserver: Only set Etag if not already set (fix #5546) (#5547)\n  * fileserver: Fix file browser breadcrumb font (#5543)\n  * caddyhttp: Fix h3 shutdown (#5541)\n  * fileserver: More filetypes for browse icons\n  * fileserver: Fix file browser footer in grid mode (#5536)\n  * cmd: Avoid spammy log messages (fix #5538)\n  * httpcaddyfile: Sort Caddyfile slice\n  * caddyhttp: Implement named routes, `invoke` directive (#5107)\n  * rewrite: use escaped path, fix #5278 (#5504)\n  * headers: Add \u003e Caddyfile shortcut for enabling defer (#5535)\n  * go.mod: Upgrade several dependencies\n  * reverseproxy: Expand port ranges to multiple upstreams in CLI + Caddyfile (#5494)\n  * fileserver: Use EscapedPath for browse (#5534)\n  * caddyhttp: Refactor cert Managers (fix #5415) (#5533)\n  * Slightly more helpful error message\n  * caddytls: Check for nil ALPN; close #5470 (#5473)\n  * cmd: Reduce spammy logs from --watch\n  * caddyhttp: Add a getter for Server.name (#5531)\n  * caddytls: Configurable fallback SNI (#5527)\n  * caddyhttp: Update quic's TLS configs after reload (#5517) (fix #4849)\n  * Add doc comment about changing admin endpoint\n  * feature: watch include directory (#5521)\n  * chore: remove deprecated linters (#5525)\n  * go.mod: Upgrade CertMagic again\n  * go.mod: Upgrade CertMagic\n  * reverseproxy: Optimize base case for least_conn and random_choose policies (#5487)\n  * reverseproxy: Fix active health check header canonicalization, refactor (#5446)\n  * reverseproxy: Add `fallback` for some policies, instead of always random (#5488)\n  * logging: Actually honor the SoftStart parameter\n  * logging: Soft start for net writer (close #5520)\n  * fastcgi: Fix `capture_stderr` (#5515)\n  * acmeserver: Configurable `resolvers`, fix smallstep deprecations (#5500)\n  * go.mod: Update some dependencies\n  * logging: Add traceID field to access logs when tracing is active (#5507)\n  * caddyhttp: Impl `ResponseWriter.Unwrap()`, prep for Go 1.20's `ResponseController` (#5509)\n  * reverseproxy: Fix reinitialize upstream healthy metrics (#5498)\n  * fix some comments (#5508)\n  * templates: Add `fileStat` function (#5497)\n  * caddyfile: Stricter parsing, error for brace on new line (#5505)\n  * core: Return default logger if no modules loaded\n  * celmatcher: Implement `pkix.Name` conversion to string (#5492)\n  * chore: Adjustments to CI caching (#5495)\n  * reverseproxy: Remove deprecated `lookup_srv` (#5396)\n  * cmd: Support `'` quotes in envfile parsing (#5437)\n  * Update contributing guidelines (#5466)\n  * caddyhttp: Serve http2 when listener wrapper doesn't return *tls.Conn (#4929)\n  * reverseproxy: Add `query` and `client_ip_hash` lb policies (#5468)\n  * cmd: Create pidfile before config load (close #5477)\n  * fileserver: Add color-scheme meta tag (#5475)\n  * proxyprotocol: Add PROXY protocol support to `reverse_proxy`, add HTTP listener wrapper (#5424)\n  * reverseproxy: Add mention of which half a copyBuffer err comes from (#5472)\n  * caddyhttp: Log request body bytes read (#5461)\n  * log: Make sink logs encodable (#5441)\n  * caddytls: Eval replacer on automation policy subjects (#5459)\n  * headers: Support deleting all headers as first op (#5464)\n  * replacer: Add HTTP time format (#5458)\n  * reverseproxy: Header up/down support for CLI command (#5460)\n  * caddyhttp: Determine real client IP if trusted proxies configured (#5104)\n  * httpcaddyfile: Adjust path matcher sorting to solve for specificity (#5462)\n  * caddytls: Zero out throttle window first (#5443)\n  * ci: add `--yes` to cosign arguments (#5440)\n  * reverseproxy: Reset Content-Length to prevent FastCGI from hanging (#5435)\n  * caddytls: Allow on-demand w/o ask for internal-only\n  * caddytls: Require 'ask' endpoint for on-demand TLS\n  * fileserver: New file browse template (#5427)\n  * go.mod: Upgrade dependencies\n  * tracing: Support autoprop from OTEL_PROPAGATORS (#5147)\n  * caddyhttp: Enable 0-RTT QUIC (#5425)\n  * encode: flush status code when hijacked. (#5419)\n  * fileserver: Remove trailing slash on fs filenames (#5417)\n  * core: Eliminate unnecessary shutdown delay on Unix (#5413)\n  * caddyhttp: Fix `vars_regexp` matcher with placeholders (#5408)\n  * context: Rename func to `AppIfConfigured` (#5397)\n  * reverseproxy: allow specifying ip version for dynamic `a` upstream (#5401)\n  * caddyfile: Fix heredoc fuzz crasher, drop trailing newline (#5404)\n  * caddyfile: Implement heredoc support (#5385)\n  * cmd: Expand cobra support, add short flags (#5379)\n  * ci: Update minimum Go version to 1.19\n  * go.mod: Upgrade quic-go to v0.33.0 (Go 1.19 min)\n  * reverseproxy: refactor HTTP transport layer (#5369)\n  * caddytls: Relax the warning for on-demand (#5384)\n  * cmd: Strict unmarshal for validate (#5383)\n  * caddyfile: Implement variadics for import args placeholders (#5249)\n  * cmd: make `caddy fmt` hints more clear (#5378)\n  * cmd: Adjust documentation for commands (#5377)\n\n\n- Update to version 2.6.4:\n\n  * reverseproxy: Don't buffer chunked requests (fix #5366) (#5367)\n","status":"published","published":"2024-07-22T09:11:35Z","modified":"2026-02-04T02:34:36.086318Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:0220-1","title":"Security update for caddy","description":"This update for caddy fixes the following issues:\n\n- Update to version 2.8.4:\n\n  * cmd: fix regression in auto-detect of Caddyfile (#6362)\n  * Tag v2.8.3 was mistakenly made on the v2.8.2 commit and is skipped\n\n- Update to version 2.8.2:\n\n  * cmd: fix auto-detetction of .caddyfile extension (#6356)\n  * caddyhttp: properly sanitize requests for root path (#6360)\n  * caddytls: Implement certmagic.RenewalInfoGetter\n  * build(deps): bump golangci/golangci-lint-action from 5 to 6 (#6361)\n\n- Update to version 2.8.1:\n\n  * caddyhttp: Fix merging consecutive `client_ip` or `remote_ip` matchers (#6350)\n  * core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)\n\n- Update to version 2.8.0:\n\n  * acmeserver: Add `sign_with_root` for Caddyfile (#6345)\n  * caddyfile: Reject global request matchers earlier (#6339)\n  * core: Fix bug in AppIfConfigured (fix #6336)\n  * fix a typo (#6333)\n  * autohttps: Move log WARN to INFO, reduce confusion (#6185)\n  * reverseproxy: Support HTTP/3 transport to backend (#6312)\n  * context: AppIfConfigured returns error; consider not-yet-provisioned modules (#6292)\n  * Fix lint error about deprecated method in smallstep/certificates/authority\n  * go.mod: Upgrade dependencies\n  * caddytls: fix permission requirement with AutomationPolicy (#6328)\n  * caddytls: remove ClientHelloSNICtxKey (#6326)\n  * caddyhttp: Trace individual middleware handlers (#6313)\n  * templates: Add `pathEscape` template function and use it in file browser (#6278)\n  * caddytls: set server name in context (#6324)\n  * chore: downgrade minimum Go version in go.mod (#6318)\n  * caddytest: normalize the JSON config (#6316)\n  * caddyhttp: New experimental handler for intercepting responses (#6232)\n  * httpcaddyfile: Set challenge ports when http_port or https_port are used\n  * logging: Add support for additional logger filters other than hostname (#6082)\n  * caddyhttp: Log 4xx as INFO; 5xx as ERROR (close #6106)\n  * Second half of 6dce493\n  * caddyhttp: Alter log message when request is unhandled (close #5182)\n  * chore: Bump Go version in CI (#6310)\n  * go.mod: go 1.22.3\n  * Fix typos (#6311)\n  * reverseproxy: Pointer to struct when loading modules; remove LazyCertPool (#6307)\n  * tracing: add trace_id var (`http.vars.trace_id` placeholder) (#6308)\n  * go.mod: CertMagic v0.21.0\n  * reverseproxy: Implement health_follow_redirects (#6302)\n  * caddypki: Allow use of root CA without a key. Fixes #6290 (#6298)\n  * go.mod: Upgrade to quic-go v0.43.1\n  * reverseproxy: HTTP transport: fix PROXY protocol initialization (#6301)\n  * caddytls: Ability to drop connections (close #6294)\n  * build(deps): bump golangci/golangci-lint-action from 4 to 5 (#6289)\n  * httpcaddyfile: Fix expression matcher shortcut in snippets (#6288)\n  * caddytls: Evict internal certs from cache based on issuer (#6266)\n  * chore: add warn logs when using deprecated fields (#6276)\n  * caddyhttp: Fix linter warning about deprecation\n  * go.mod: Upgrade to quic-go v0.43.0\n  * fileserver: Set 'Vary: Accept-Encoding' header (see #5849)\n  * events: Add debug log\n  * reverseproxy: handle buffered data during hijack (#6274)\n  * ci: remove `android` and `plan9` from cross-build workflow (#6268)\n  * run `golangci-lint run --fix --fast` (#6270)\n  * caddytls: Option to configure certificate lifetime (#6253)\n  * replacer: Implement `file.*` global replacements (#5463)\n  * caddyhttp: Address some Go 1.20 features (#6252)\n  * Quell linter (false positive)\n  * reverse_proxy: Add grace_period for SRV upstreams to Caddyfile (#6264)\n  * doc: add `verifier` in `ClientAuthentication` caddyfile marshaler doc (#6263)\n  * caddytls: Add Caddyfile support for on-demand permission module (close #6260)\n  * reverseproxy: Remove long-deprecated buffering properties\n  * reverseproxy: Reuse buffered request body even if partially drained\n  * reverseproxy: Accept EOF when buffering\n  * logging: Fix default access logger (#6251)\n  * fileserver: Improve Vary handling (#5849)\n  * cmd: Only validate config is proper JSON if config slice has data (#6250)\n  * staticresp: Use the evaluated response body for sniffing JSON content-type (#6249)\n  * encode: Slight fix for the previous commit\n  * encode: Improve Etag handling (fix #5849)\n  * httpcaddyfile: Skip automate loader if disable_certs is specified (fix #6148)\n  * caddyfile: Populate regexp matcher names by default (#6145)\n  * caddyhttp: record num. bytes read when response writer is hijacked (#6173)\n  * caddyhttp: Support multiple logger names per host (#6088)\n  * chore: fix some typos in comments (#6243)\n  * encode: Configurable compression level for zstd (#6140)\n  * caddytls: Remove shim code supporting deprecated lego-dns (#6231)\n  * connection policy: add `local_ip`  matcher (#6074)\n  * reverseproxy: Wait for both ends of websocket to close (#6175)\n  * caddytls: Upgrade ACMEz to v2; support ZeroSSL API; various fixes (#6229)\n  * caddytls: Still provision permission module if ask is specified\n  * fileserver: read etags from precomputed files (#6222)\n  * fileserver: Escape # and ? in img src (fix #6237)\n  * reverseproxy: Implement modular CA provider for TLS transport (#6065)\n  * caddyhttp: Apply auto HTTPS redir to all interfaces (fix #6226)\n  * cmd: Fix panic related to config filename (fix #5919)\n  * cmd: Assume Caddyfile based on filename prefix and suffix (#5919)\n  * admin: Make `Etag` a header, not a trailer (#6208)\n  * caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234)\n  * caddyconfig: Use empty struct instead of bool in map (close #6224) (#6227)\n  * gitignore: Add rule for caddyfile.go (#6225)\n  * chore: Fix broken links in README.md (#6223)\n  * chore: Upgrade some dependencies (#6221)\n  * caddyhttp: Add plaintext response to `file_server browse` (#6093)\n  * admin: Use xxhash for etag (#6207)\n  * modules: fix some typo in conments (#6206)\n  * caddyhttp: Replace sensitive headers with REDACTED (close #5669)\n  * caddyhttp: close quic connections when server closes (#6202)\n  * reverseproxy: Use xxhash instead of fnv32 for LB (#6203)\n  * caddyhttp: add http.request.local{,.host,.port} placeholder (#6182)\n  * chore: upgrade deps (#6198)\n  * chore: remove repetitive word (#6193)\n  * Added a null check to avoid segfault on rewrite query ops (#6191)\n  * rewrite: `uri query` replace operation (#6165)\n  * logging: support `ms` duration format and add docs (#6187)\n  * replacer: use RWMutex to protect static provider (#6184)\n  * caddyhttp: Allow `header` replacement with empty string (#6163)\n  * vars: Make nil values act as empty string instead of `'\u003cnil\u003e'` (#6174)\n  * chore: Update quic-go to v0.42.0 (#6176)\n  * caddyhttp: Accept XFF header values with ports, when parsing client IP (#6183)\n  * reverseproxy: configurable active health_passes and health_fails (#6154)\n  * reverseproxy: Configurable forward proxy URL (#6114)\n  * caddyhttp: upgrade to cel v0.20.0 (#6161)\n  * chore: Bump Chroma to v2.13.0, includes new Caddyfile lexer (#6169)\n  * caddyhttp: suppress flushing if the response is being buffered (#6150)\n  * chore: encode: use FlushError instead of Flush (#6168)\n  * encode: write status immediately when status code is informational (#6164)\n  * httpcaddyfile: Keep deprecated `skip_log` in directive order (#6153)\n  * httpcaddyfile: Add `RegisterDirectiveOrder` function for plugin authors (#5865)\n  * rewrite: Implement `uri query` operations (#6120)\n  * fix struct names (#6151)\n  * fileserver: Preserve query during canonicalization redirect (#6109)\n  * logging: Implement `log_append` handler (#6066)\n  * httpcaddyfile: Allow nameless regexp placeholder shorthand (#6113)\n  * logging: Implement `append` encoder, allow flatter filters config (#6069)\n  * ci: fix the integration test `TestLeafCertLoaders` (#6149)\n  * vars: Allow overriding `http.auth.user.id` in replacer as a special case (#6108)\n  * caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)\n  * cmd: Adjust config load logs/errors (#6032)\n  * reverseproxy: SRV dynamic upstream failover (#5832)\n  * ci: bump golangci/golangci-lint-action from 3 to 4 (#6141)\n  * core: OnExit hooks (#6128)\n  * cmd: fix the output of the `Usage` section (#6138)\n  * caddytls: verifier: caddyfile: re-add Caddyfile support (#6127)\n  * acmeserver: add policy field to define allow/deny rules (#5796)\n  * reverseproxy: cookie should be Secure and SameSite=None when TLS (#6115)\n  * caddytest: Rename adapt tests to `*.caddyfiletest` extension (#6119)\n  * tests: uses testing.TB interface for helper to be able to use test server in benchmarks. (#6103)\n  * caddyfile: Assert having a space after heredoc marker to simply check (#6117)\n  * chore: Update Chroma to get the new Caddyfile lexer (#6118)\n  * reverseproxy: use context.WithoutCancel (#6116)\n  * caddyfile: Reject directives in the place of site addresses (#6104)\n  * caddyhttp: Register post-shutdown callbacks (#5948)\n  * caddyhttp: Only attempt to enable full duplex for HTTP/1.x (#6102)\n  * caddyauth: Drop support for `scrypt` (#6091)\n  * Revert 'caddyfile: Reject long heredoc markers (#6098)' (#6100)\n  * caddyauth: Rename `basicauth` to `basic_auth` (#6092)\n  * logging: Inline Caddyfile syntax for `ip_mask` filter (#6094)\n  * caddyfile: Reject long heredoc markers (#6098)\n  * chore: Rename CI jobs, run on M1 mac (#6089)\n  * update comment\n  * improved list\n  * fix: add back text/*\n  * fix: add more media types to the compressed by default list\n  * acmeserver: support specifying the allowed challenge types (#5794)\n  * matchers: Drop `forwarded` option from `remote_ip` matcher (#6085)\n  * caddyhttp: Test cases for `%2F` and `%252F` (#6084)\n  * bump to golang 1.22 (#6083)\n  * fileserver: Browse can show symlink target if enabled (#5973)\n  * core: Support NO_COLOR env var to disable log coloring (#6078)\n  * build(deps): bump peter-evans/repository-dispatch from 2 to 3 (#6080)\n  * Update comment in setcap helper script\n  * caddytls: Make on-demand 'ask' permission modular (#6055)\n  * core: Add `ctx.Slogger()` which returns an `slog` logger (#5945)\n  * chore: Update quic-go to v0.41.0, bump Go minimum to 1.21 (#6043)\n  * chore: enabling a few more linters (#5961)\n  * caddyfile: Correctly close the heredoc when the closing marker appears immediately (#6062)\n  * caddyfile: Switch to slices.Equal for better performance (#6061)\n  * tls: modularize trusted CA providers (#5784)\n  * logging: Automatic `wrap` default for `filter` encoder (#5980)\n  * caddyhttp: Fix panic when request missing ClientIPVarKey (#6040)\n  * caddyfile: Normalize \u0026 flatten all unmarshalers (#6037)\n  * cmd: reverseproxy: log: use caddy logger (#6042)\n  * matchers: `query` now ANDs multiple keys (#6054)\n  * caddyfile: Add heredoc support to `fmt` command (#6056)\n  * refactor: move automaxprocs init in caddycmd.Main()\n  * caddyfile: Allow heredoc blank lines (#6051)\n  * httpcaddyfile: Add optional status code argument to `handle_errors` directive (#5965)\n  * httpcaddyfile: Rewrite `root` and `rewrite` parsing to allow omitting matcher (#5844)\n  * fileserver: Implement caddyfile.Unmarshaler interface (#5850)\n  * reverseproxy: Add `tls_curves` option to HTTP transport (#5851)\n  * caddyhttp: Security enhancements for client IP parsing (#5805)\n  * replacer: Fix escaped closing braces (#5995)\n  * filesystem: Globally declared filesystems, `fs` directive (#5833)\n  * ci/cd: use the build tag `nobadger` to exclude badgerdb (#6031)\n  * httpcaddyfile: Fix redir \u003cto\u003e html (#6001)\n  * httpcaddyfile: Support client auth verifiers (#6022)\n  * tls: add reuse_private_keys (#6025)\n  * reverseproxy: Only change Content-Length when full request is buffered (#5830)\n  * Switch Solaris-derivatives away from listen_unix (#6021)\n  * build(deps): bump actions/upload-artifact from 3 to 4 (#6013)\n  * build(deps): bump actions/setup-go from 4 to 5 (#6012)\n  * chore: check against errors of `io/fs` instead of `os` (#6011)\n  * caddyhttp: support unix sockets in `caddy respond` command (#6010)\n  * fileserver: Add total file size to directory listing (#6003)\n  * httpcaddyfile: Fix cert file decoding to load multiple PEM in one file (#5997)\n  * build(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 (#5994)\n  * cmd: use automaxprocs for better perf in containers (#5711)\n  * logging: Add `zap.Option` support (#5944)\n  * httpcaddyfile: Sort skip_hosts for deterministic JSON (#5990)\n  * metrics: Record request metrics on HTTP errors (#5979)\n  * go.mod: Updated quic-go to v0.40.1 (#5983)\n  * fileserver: Enable compression for command by default (#5855)\n  * fileserver: New --precompressed flag (#5880)\n  * caddyhttp: Add `uuid` to access logs when used (#5859)\n  * proxyprotocol: use github.com/pires/go-proxyproto (#5915)\n  * cmd: Preserve LastModified date when exporting storage (#5968)\n  * core: Always make AppDataDir for InstanceID (#5976)\n  * chore: cross-build for AIX (#5971)\n  * caddytls: Sync distributed storage cleaning (#5940)\n  * caddytls: Context to DecisionFunc (#5923)\n  * tls: accept placeholders in string values of certificate loaders (#5963)\n  * templates: Offically make templates extensible (#5939)\n  * http2 uses new round-robin scheduler (#5946)\n  * panic when reading from backend failed to propagate stream error (#5952)\n  * chore: Bump otel to v1.21.0. (#5949)\n  * httpredirectlistener: Only set read limit for when request is HTTP (#5917)\n  * fileserver: Add .m4v for browse template icon\n  * Revert 'caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)' (#5924)\n  * go.mod: update quic-go version to v0.40.0 (#5922)\n  * update quic-go to v0.39.3 (#5918)\n  * chore: Fix usage pool comment (#5916)\n  * test: acmeserver: add smoke test for the ACME server directory (#5914)\n  *  Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)\n  * caddyhttp: Adjust `scheme` placeholder docs (#5910)\n  * go.mod: Upgrade quic-go to v0.39.1\n  * go.mod: CVE-2023-45142 Update opentelemetry (#5908)\n  * templates: Delete headers on `httpError` to reset to clean slate (#5905)\n  * httpcaddyfile: Remove port from logger names (#5881)\n  * core: Apply SO_REUSEPORT to UDP sockets (#5725)\n  * caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)\n  * cmd: Add newline character to version string in CLI output (#5895)\n  * core: quic listener will manage the underlying socket by itself (#5749)\n  * templates: Clarify `include` args docs, add `.ClientIP` (#5898)\n  * httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)\n  * cmd: upgrade: resolve symlink of the executable (#5891)\n  * caddyfile: Fix variadic placeholder false positive when token contains `:` (#5883)\n\n- CVEs:\n  * CVE-2024-22189 (boo#1222468)\n  * CVE-2023-45142\n\n- Update to version 2.7.6:\n\n  * caddytls: Sync distributed storage cleaning (#5940)\n  * caddytls: Context to DecisionFunc (#5923)\n  * tls: accept placeholders in string values of certificate loaders (#5963)\n  * templates: Offically make templates extensible (#5939)\n  * http2 uses new round-robin scheduler (#5946)\n  * panic when reading from backend failed to propagate stream error (#5952)\n  * chore: Bump otel to v1.21.0. (#5949)\n  * httpredirectlistener: Only set read limit for when request is HTTP (#5917)\n  * fileserver: Add .m4v for browse template icon\n  * Revert 'caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)' (#5924)\n  * go.mod: update quic-go version to v0.40.0 (#5922)\n  * update quic-go to v0.39.3 (#5918)\n  * chore: Fix usage pool comment (#5916)\n  * test: acmeserver: add smoke test for the ACME server directory (#5914)\n  * Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)\n  * caddyhttp: Adjust `scheme` placeholder docs (#5910)\n  * go.mod: Upgrade quic-go to v0.39.1\n  * go.mod: CVE-2023-45142 Update opentelemetry (#5908)\n  * templates: Delete headers on `httpError` to reset to clean slate (#5905)\n  * httpcaddyfile: Remove port from logger names (#5881)\n  * core: Apply SO_REUSEPORT to UDP sockets (#5725)\n  * caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)\n  * cmd: Add newline character to version string in CLI output (#5895)\n  * core: quic listener will manage the underlying socket by itself (#5749)\n  * templates: Clarify `include` args docs, add `.ClientIP` (#5898)\n  * httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)\n  * cmd: upgrade: resolve symlink of the executable (#5891)\n  * caddyfile: Fix variadic placeholder false positive when token contains `:` (#5883)\n\n- Update to version 2.7.5:\n\n  * admin: Respond with 4xx on non-existing config path (#5870)\n  * ci: Force the Go version for govulncheck (#5879)\n  * fileserver: Set canonical URL on browse template (#5867)\n  * tls: Add X25519Kyber768Draft00 PQ 'curve' behind build tag (#5852)\n  * reverseproxy: Add more debug logs (#5793)\n  * reverseproxy: Fix `least_conn` policy regression (#5862)\n  * reverseproxy: Add logging for dynamic A upstreams (#5857)\n  * reverseproxy: Replace health header placeholders (#5861)\n  * httpcaddyfile: Sort TLS SNI matcher for deterministic JSON output (#5860)\n  * cmd: Fix exiting with custom status code, add `caddy -v` (#5874)\n  * reverseproxy: fix parsing Caddyfile fails for unlimited request/response buffers (#5828)\n  * reverseproxy: Fix retries on 'upstreams unavailable' error (#5841)\n  * httpcaddyfile: Enable TLS for catch-all site if `tls` directive is specified (#5808)\n  * encode: Add `application/wasm*` to the default content types (#5869)\n  * fileserver: Add command shortcuts `-l` and `-a` (#5854)\n  * go.mod: Upgrade dependencies incl. x/net/http\n  * templates: Add dummy `RemoteAddr` to `httpInclude` request, proxy compatibility (#5845)\n  * reverseproxy: Allow fallthrough for response handlers without routes (#5780)\n  * fix: caddytest.AssertResponseCode error message (#5853)\n  * build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#5847)\n  * build(deps): bump actions/checkout from 3 to 4 (#5846)\n  * caddyhttp: Use LimitedReader for HTTPRedirectListener\n  * fileserver: browse template SVG icons and UI tweaks (#5812)\n  * reverseproxy: fix nil pointer dereference in AUpstreams.GetUpstreams (#5811)\n  * httpcaddyfile: fix placeholder shorthands in named routes (#5791)\n  * cmd: Prevent overwriting existing env vars with `--envfile` (#5803)\n  * ci: Run govulncheck (#5790)\n  * logging: query filter for array of strings (#5779)\n  * logging: Clone array on log filters, prevent side-effects (#5786)\n  * fileserver: Export BrowseTemplate\n  * ci: ensure short-sha is exported correctly on all platforms (#5781)\n  * caddyfile: Fix case where heredoc marker is empty after newline (#5769)\n  * go.mod: Update quic-go to v0.38.0 (#5772)\n  * chore: Appease gosec linter (#5777)\n  * replacer: change timezone to UTC for 'time.now.http' placeholders (#5774)\n  * caddyfile: Adjust error formatting (#5765)\n  * update quic-go to v0.37.6 (#5767)\n  * httpcaddyfile: Stricter errors for site and upstream address schemes (#5757)\n  * caddyfile: Loosen heredoc parsing (#5761)\n  * fileserver: docs: clarify the ability to produce JSON array with `browse` (#5751)\n  * fix package typo (#5764)\n","status":"published","published":"2024-07-26T10:03:44Z","modified":"2026-02-04T03:41:10.459222Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13360-1","title":"teleport-14.1.1-1.1 on GA media","description":"These are all security issues fixed in the teleport-14.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:20.313427Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13495-1","title":"caddy-2.7.6-1.1 on GA media","description":"These are all security issues fixed in the caddy-2.7.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:23.306071Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14232-1","title":"golang-github-prometheus-prometheus-2.53.0-3.1 on GA media","description":"These are all security issues fixed in the golang-github-prometheus-prometheus-2.53.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-01T00:00:00Z","modified":"2026-02-04T03:39:32.982773Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14320-1","title":"containerd-1.7.21-1.1 on GA media","description":"These are all security issues fixed in the containerd-1.7.21-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-06T00:00:00Z","modified":"2026-02-04T03:29:05.707282Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14321-1","title":"docker-26.1.5_ce-2.1 on GA media","description":"These are all security issues fixed in the docker-26.1.5_ce-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-06T00:00:00Z","modified":"2026-02-04T03:05:25.556547Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:3188-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- Update to containerd v1.7.21\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)\n- CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)\n","status":"published","published":"2024-09-10T08:44:48Z","modified":"2026-02-04T02:52:30.235433Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3221-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- Update to containerd v1.7.21\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)\n- CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)\n  ","status":"published","published":"2024-09-12T11:18:44Z","modified":"2026-02-04T04:12:23.562915Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3266-1","title":"Security update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2024-6104: Update go-retryablehttp to version 0.7.7 (bsc#1227038)\n  * CVE-2023-45142: Updated otelhttp to version 0.46.1 (bsc#1228556)\n\n- Require Go \u003e 1.20 for building\n- Migrate from `disabled` to `manual` service mode\n- Update to 2.45.6 (jsc#PED-3577):\n  * Security fixes in dependencies\n- Update to 2.45.5:\n  * [BUGFIX] tsdb/agent: ensure that new series get written to WAL\n    on rollback.\n  * [BUGFIX] Remote write: Avoid a race condition when applying\n    configuration.\n- Update to 2.45.4:\n  * [BUGFIX] Remote read: Release querier resources before encoding\n    the results.\n- Update to 2.45.3:\n  * [BUGFIX] TSDB: Remove double memory snapshot on shutdown.\n- Update to 2.45.2:\n  * [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new\n    series.\n- Update to 2.45.1:\n  * [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used\n    by Hetzner in September.\n  * [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid\n    overflows on 386 architecture.\n  * [BUGFIX] TSDB: Handle TOC parsing failures.\n\nrhnlib:\n    \n- Version 5.0.4-0\n  * Add the old TLS code for very old traditional clients still on\n    python 2.7 (bsc#1228198)\n\nspacecmd:\n\n- Version 5.0.9-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 0.1.21-0\n  * mgrpxy: Fix typo on Systemd template\n- Version 0.1.20-0\n  * Update the push tag to 5.0.1\n  * mgrpxy: expose port on IPv6 network (bsc#1227951)\n- Version 0.1.19-0\n  * Skip updating Tomcat remote debug if conf file is not present\n- Version 0.1.18-0\n  * Setup Confidential Computing container during migration\n    (bsc#1227588)\n  * Add the /etc/uyuni/uyuni-tools.yaml path to the config help\n  * Split systemd config files to not loose configuration at upgrade\n    (bsc#1227718)\n  * Use the same logic for image computation in mgradm and mgrpxy\n    (bsc#1228026)\n  * Allow building with different Helm and container default\n    registry paths (bsc#1226191)\n  * Fix recursion in mgradm upgrade podman list --help\n  * Setup hub xmlrpc API service in migration to Podman (bsc#1227588)\n  * Setup disabled hub xmlrpc API service in all cases (bsc#1227584)\n  * Clean the inspection code to make it faster\n  * Properly detect IPv6 enabled on Podman network (bsc#1224349)\n  * Fix the log file path generation\n  * Write scripts output to uyuni-tools.log file\n  * Add uyuni-hubxml-rpc to the list of values in\n    mgradm scale --help\n  * Use path in mgradm support sql file input (bsc#1227505)\n  * On Ubuntu build with go1.21 instead of go1.20\n  * Enforce Cobbler setup (bsc#1226847)\n  * Expose port on IPv6 network (bsc#1227951)\n  * show output of podman image search --list-tags command\n  * Implement mgrpxy support config command\n  * During migration, ignore /etc/sysconfig/tomcat and\n    /etc/tomcat/tomcat.conf (bsc#1228183)\n  * During migration, remove java.annotation,com.sun.xml.bind and\n    UseConcMarkSweepGC settings\n  * Disable node exporter port for Kubernetes\n  * Fix start, stop and restart in Kubernetes\n  * Increase start timeout in Kubernetes\n  * Fix traefik query\n  * Fix password entry usability (bsc#1226437)\n  * Add --prepare option to migrate command\n  * Fix random error during installation of CA certificate\n    (bsc#1227245)\n  * Clarify and fix distro name guessing when not provided\n    (bsc#1226284)\n  * Replace not working Fatal error by plain error return\n    (bsc#1220136)\n  * Allow server installation with preexisting storage volumes\n  * Do not report error when purging mounted volume (bsc#1225349)\n  * Preserve PAGER settings from the host for interactive sql\n    usage (bsc#1226914)\n  * Add mgrpxy command to clear the Squid cache\n  * Use local images for Confidential Computing and\n    Hub containers (bsc#1227586)\n- Version 0.1.17-0\n  * Allow GPG files to be loaded from the local file (bsc#1227195)\n- Version 0.1.16-0\n  * Prefer local images in all migration steps (bsc#1227244)\n- Version 0.1.15-0\n  * Define --registry flag behaviour (bsc#1226793)\n- Version 0.1.14-0\n  * Do not rely on hardcoded registry, remove any FQDN\n- Version 0.1.13-0\n  * Fix mgradm support config tarball creation (bsc#1226759)\n- Version 0.1.12-0\n  * Detection of k8s on Proxy was wrongly influenced by Server\n    setting\n","status":"published","published":"2024-09-17T07:42:22Z","modified":"2026-02-04T02:48:00.019144Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3267-1","title":"Security update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2024-6104: Update go-retryablehttp to version 0.7.7 (bsc#1227038)\n  * CVE-2023-45142: Updated otelhttp to version 0.46.1 (bsc#1228556)\n\n- Require Go \u003e 1.20 for building\n- Migrate from `disabled` to `manual` service mode\n- Update to 2.45.6 (jsc#PED-3577):\n  * Security fixes in dependencies\n- Update to 2.45.5:\n  * [BUGFIX] tsdb/agent: ensure that new series get written to WAL\n    on rollback.\n  * [BUGFIX] Remote write: Avoid a race condition when applying\n    configuration.\n- Update to 2.45.4:\n  * [BUGFIX] Remote read: Release querier resources before encoding\n    the results.\n- Update to 2.45.3:\n  * [BUGFIX] TSDB: Remove double memory snapshot on shutdown.\n- Update to 2.45.2:\n  * [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new\n    series.\n- Update to 2.45.1:\n  * [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used\n    by Hetzner in September.\n  * [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid\n    overflows on 386 architecture.\n  * [BUGFIX] TSDB: Handle TOC parsing failures.\n\nrhnlib:\n    \n- Version 5.0.4-0\n  * Add the old TLS code for very old traditional clients still on\n    python 2.7 (bsc#1228198)\n\nspacecmd:\n\n- Version 5.0.9-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 0.1.21-0\n  * mgrpxy: Fix typo on Systemd template\n- Version 0.1.20-0\n  * Update the push tag to 5.0.1\n  * mgrpxy: expose port on IPv6 network (bsc#1227951)\n- Version 0.1.19-0\n  * Skip updating Tomcat remote debug if conf file is not present\n- Version 0.1.18-0\n  * Setup Confidential Computing container during migration\n    (bsc#1227588)\n  * Add the /etc/uyuni/uyuni-tools.yaml path to the config help\n  * Split systemd config files to not loose configuration at upgrade\n    (bsc#1227718)\n  * Use the same logic for image computation in mgradm and mgrpxy\n    (bsc#1228026)\n  * Allow building with different Helm and container default\n    registry paths (bsc#1226191)\n  * Fix recursion in mgradm upgrade podman list --help\n  * Setup hub xmlrpc API service in migration to Podman (bsc#1227588)\n  * Setup disabled hub xmlrpc API service in all cases (bsc#1227584)\n  * Clean the inspection code to make it faster\n  * Properly detect IPv6 enabled on Podman network (bsc#1224349)\n  * Fix the log file path generation\n  * Write scripts output to uyuni-tools.log file\n  * Add uyuni-hubxml-rpc to the list of values in\n    mgradm scale --help\n  * Use path in mgradm support sql file input (bsc#1227505)\n  * On Ubuntu build with go1.21 instead of go1.20\n  * Enforce Cobbler setup (bsc#1226847)\n  * Expose port on IPv6 network (bsc#1227951)\n  * show output of podman image search --list-tags command\n  * Implement mgrpxy support config command\n  * During migration, ignore /etc/sysconfig/tomcat and\n    /etc/tomcat/tomcat.conf (bsc#1228183)\n  * During migration, remove java.annotation,com.sun.xml.bind and\n    UseConcMarkSweepGC settings\n  * Disable node exporter port for Kubernetes\n  * Fix start, stop and restart in Kubernetes\n  * Increase start timeout in Kubernetes\n  * Fix traefik query\n  * Fix password entry usability (bsc#1226437)\n  * Add --prepare option to migrate command\n  * Fix random error during installation of CA certificate\n    (bsc#1227245)\n  * Clarify and fix distro name guessing when not provided\n    (bsc#1226284)\n  * Replace not working Fatal error by plain error return\n    (bsc#1220136)\n  * Allow server installation with preexisting storage volumes\n  * Do not report error when purging mounted volume (bsc#1225349)\n  * Preserve PAGER settings from the host for interactive sql\n    usage (bsc#1226914)\n  * Add mgrpxy command to clear the Squid cache\n  * Use local images for Confidential Computing and\n    Hub containers (bsc#1227586)\n- Version 0.1.17-0\n  * Allow GPG files to be loaded from the local file (bsc#1227195)\n- Version 0.1.16-0\n  * Prefer local images in all migration steps (bsc#1227244)\n- Version 0.1.15-0\n  * Define --registry flag behaviour (bsc#1226793)\n- Version 0.1.14-0\n  * Do not rely on hardcoded registry, remove any FQDN\n- Version 0.1.13-0\n  * Fix mgradm support config tarball creation (bsc#1226759)\n- Version 0.1.12-0\n  * Detection of k8s on Proxy was wrongly influenced by Server\n    setting\n\n","status":"published","published":"2024-09-17T07:43:02Z","modified":"2026-02-04T02:50:02.008555Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3288-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\n- Require Go \u003e 1.20 for building\n\n- Bump go-retryablehttp to version 0.7.7\n  (CVE-2024-6104, bsc#1227038)\n- Migrate from `disabled` to `manual` service mode\n- Add0003-Bump-go-retryablehttp.patch\n- Update to 2.45.6 (jsc#PED-3577):\n  * Security fixes in dependencies\n- Update to 2.45.5:\n  * [BUGFIX] tsdb/agent: ensure that new series get written to WAL\n    on rollback.\n  * [BUGFIX] Remote write: Avoid a race condition when applying\n    configuration.\n- Update to 2.45.4:\n  * [BUGFIX] Remote read: Release querier resources before encoding\n    the results.\n- Update to 2.45.3:\n  * Security fixes in dependencies\n  * [BUGFIX] TSDB: Remove double memory snapshot on shutdown.\n- Update to 2.45.2:\n  * Security fixes in dependencies\n  * [SECURITY] Updated otelhttp to version 0.46.1\n    (CVE-2023-45142, bsc#1228556)\n  * [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new\n    series.\n- Update to 2.45.1:\n  * [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used\n    by Hetzner in September.\n  * [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid\n    overflows on 386 architecture.\n  * [BUGFIX] TSDB: Handle TOC parsing failures.\n\n- update to 2.45.0 (jsc#PED-5406):\n  * [FEATURE] API: New limit parameter to limit the number of items\n    returned by `/api/v1/status/tsdb` endpoint. \n  * [FEATURE] Config: Add limits to global config. \n  * [FEATURE] Consul SD: Added support for `path_prefix`. \n  * [FEATURE] Native histograms: Add option to scrape both classic\n    and native histograms. \n  * [FEATURE] Native histograms: Added support for two more\n    arithmetic operators `avg_over_time` and `sum_over_time`.\n  * [FEATURE] Promtool: When providing the block id, only one block\n    will be loaded and analyzed. \n  * [FEATURE] Remote-write: New Azure ad configuration to support\n    remote writing directly to Azure Monitor workspace. \n  * [FEATURE] TSDB: Samples per chunk are now configurable with\n    flag `storage.tsdb.samples-per-chunk`. By default set to its\n    former value 120. \n  * [ENHANCEMENT] Native histograms: bucket size can now be limited\n    to avoid scrape fails. \n  * [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL\n    sooner. \n  * [BUGFIX] Native histograms: ChunkSeries iterator now checks if\n    a new sample can be appended to the open chunk. \n  * [BUGFIX] Native histograms: Fix Histogram Appender\n    `Appendable()` segfault. \n  * [BUGFIX] Native histograms: Fix setting reset header to gauge\n    histograms in seriesToChunkEncoder. \n  * [BUGFIX] TSDB: Tombstone intervals are not modified after Get()\n    call. \n  * [BUGFIX] TSDB: Use path/filepath to set the WAL directory.\n- update to 2.44.0:\n  * [FEATURE] Remote-read: Handle native histograms. \n  * [FEATURE] Promtool: Health and readiness check of prometheus\n    server in CLI. \n  * [FEATURE] PromQL: Add `query_samples_total` metric, the total\n    number of samples loaded by all queries.\n  * [ENHANCEMENT] Storage: Optimise buffer used to iterate through\n    samples.\n  * [ENHANCEMENT] Scrape: Reduce memory allocations on target\n    labels.\n  * [ENHANCEMENT] PromQL: Use faster heap method for `topk()` /\n    `bottomk()`.\n  * [ENHANCEMENT] Rules API: Allow filtering by rule name.\n  * [ENHANCEMENT] Native Histograms: Various fixes and\n    improvements.\n  * [ENHANCEMENT] UI: Search of scraping pools is now\n    case-insensitive.\n  * [ENHANCEMENT] TSDB: Add an affirmative log message for\n    successful WAL repair.\n  * [BUGFIX] TSDB: Block compaction failed when shutting down.\n  * [BUGFIX] TSDB: Out-of-order chunks could be ignored if the\n    write-behind log was deleted.\n- rebase patch 0001-Do-not-force-the-pure-Go-name-resolver.patch\n  onto v2.44.0\n- update to 2.43.1\n  * [BUGFIX] Labels: Set() after Del() would be ignored, which\n    broke some relabeling rules.\n- update to 2.43.0:\n  * [FEATURE] Promtool: Add HTTP client configuration to query\n    commands.\n  * [FEATURE] Scrape: Add `include_scrape_configs` to include\n    scrape configs from different files.\n  * [FEATURE] HTTP client: Add `no_proxy` to exclude URLs from\n    proxied requests.\n  * [FEATURE] HTTP client: Add `proxy_from_enviroment` to read\n    proxies from env variables.\n  * [ENHANCEMENT] API: Add support for setting lookback delta per\n    query via the API.\n  * [ENHANCEMENT] API: Change HTTP status code from 503/422 to 499\n    if a request is canceled.\n  * [ENHANCEMENT] Scrape: Allow exemplars for all metric types.\n  * [ENHANCEMENT] TSDB: Add metrics for head chunks and WAL folders\n    size.\n  * [ENHANCEMENT] TSDB: Automatically remove incorrect snapshot\n    with index that is ahead of WAL.\n  * [ENHANCEMENT] TSDB: Improve Prometheus parser error outputs to\n    be more comprehensible.\n  * [ENHANCEMENT] UI: Scope `group by` labels to metric in\n    autocompletion.\n  * [BUGFIX] Scrape: Fix\n    `prometheus_target_scrape_pool_target_limit` metric not set\n    before reloading.\n  * [BUGFIX] TSDB: Correctly update\n    `prometheus_tsdb_head_chunks_removed_total` and\n    `prometheus_tsdb_head_chunks` metrics when reading WAL.\n  * [BUGFIX] TSDB: Use the correct unit (seconds) when recording\n    out-of-order append deltas in the\n    `prometheus_tsdb_sample_ooo_delta` metric.\n- update to 2.42.0:\n  This release comes with a bunch of feature coverage for native\n  histograms and breaking changes.\n  If you are trying native histograms already, we recommend you\n  remove the `wal` directory when upgrading.\n  Because the old WAL record for native histograms is not\n  backward compatible in v2.42.0, this will lead to some data\n  loss for the latest data.\n  Additionally, if you scrape 'float histograms' or use recording\n  rules on native histograms in v2.42.0 (which writes float\n  histograms), it is a one-way street since older versions do not\n  support float histograms.\n  * [CHANGE] **breaking** TSDB: Changed WAL record format for the\n    experimental native histograms.\n  * [FEATURE] Add 'keep_firing_for' field to alerting rules.\n  * [FEATURE] Promtool: Add support of selecting timeseries for\n    TSDB dump.\n  * [ENHANCEMENT] Agent: Native histogram support.\n  * [ENHANCEMENT] Rules: Support native histograms in recording\n    rules.\n  * [ENHANCEMENT] SD: Add container ID as a meta label for pod\n    targets for Kubernetes.\n  * [ENHANCEMENT] SD: Add VM size label to azure service\n    discovery.\n  * [ENHANCEMENT] Support native histograms in federation.\n  * [ENHANCEMENT] TSDB: Add gauge histogram support.\n  * [ENHANCEMENT] TSDB/Scrape: Support FloatHistogram that\n    represents buckets as float64 values.\n  * [ENHANCEMENT] UI: Show individual scrape pools on /targets\n    page.\n- update to 2.41.0:\n  * [FEATURE] Relabeling: Add keepequal and dropequal relabel\n    actions.\n  * [FEATURE] Add support for HTTP proxy headers. \n  * [ENHANCEMENT] Reload private certificates when changed on disk.\n  * [ENHANCEMENT] Add max_version to specify maximum TLS version in\n    tls_config.\n  * [ENHANCEMENT] Add goos and goarch labels to\n    prometheus_build_info.\n  * [ENHANCEMENT] SD: Add proxy support for EC2 and LightSail SDs.\n  * [ENHANCEMENT] SD: Add new metric\n    prometheus_sd_file_watcher_errors_total.\n  * [ENHANCEMENT] Remote Read: Use a pool to speed up marshalling.\n  * [ENHANCEMENT] TSDB: Improve handling of tombstoned chunks in\n    iterators.\n  * [ENHANCEMENT] TSDB: Optimize postings offset table reading.\n  * [BUGFIX] Scrape: Validate the metric name, label names, and\n    label values after relabeling.\n  * [BUGFIX] Remote Write receiver and rule manager: Fix error\n    handling.\n- update to 2.40.7:\n  * [BUGFIX] TSDB: Fix queries involving negative buckets of native\n    histograms.\n- update to 2.40.5:\n  * [BUGFIX] TSDB: Fix queries involving native histograms due to\n    improper reset of iterators.\n- update to 2.40.3:\n  * [BUGFIX] TSDB: Fix compaction after a deletion is called.\n- update to 2.40.2:\n  * [BUGFIX] UI: Fix black-on-black metric name color in dark mode.\n- update to 2.40.1:\n  * [BUGFIX] TSDB: Fix alignment for atomic int64 for 32 bit\n    architecture.\n  * [BUGFIX] Scrape: Fix accept headers.\n- update to 2.40.0:\n  * [FEATURE] Add experimental support for native histograms.\n    Enable with the flag --enable-feature=native-histograms.\n  * [FEATURE] SD: Add service discovery for OVHcloud.\n  * [ENHANCEMENT] Kubernetes SD: Use protobuf encoding.\n  * [ENHANCEMENT] TSDB: Use golang.org/x/exp/slices for improved\n    sorting speed.\n  * [ENHANCEMENT] Consul SD: Add enterprise admin partitions. Adds\n    __meta_consul_partition label. Adds partition config in\n    consul_sd_config.\n  * [BUGFIX] API: Fix API error codes for /api/v1/labels and\n    /api/v1/series.\n- update to 2.39.1:\n  * [BUGFIX] Rules: Fix notifier relabel changing the labels on\n    active alerts.\n- update to 2.39.0:\n  * [FEATURE] experimental TSDB: Add support for ingesting\n    out-of-order samples. This is configured via\n    out_of_order_time_window field in the config file; check config\n    file docs for more info.\n  * [ENHANCEMENT] API: /-/healthy and /-/ready API calls now also\n    respond to a HEAD request on top of existing GET support.\n  * [ENHANCEMENT] PuppetDB SD: Add __meta_puppetdb_query label.\n  * [ENHANCEMENT] AWS EC2 SD: Add __meta_ec2_region label.\n  * [ENHANCEMENT] AWS Lightsail SD: Add __meta_lightsail_region\n    label.\n  * [ENHANCEMENT] Scrape: Optimise relabeling by re-using memory.\n  * [ENHANCEMENT] TSDB: Improve WAL replay timings.\n  * [ENHANCEMENT] TSDB: Optimise memory by not storing unnecessary\n    data in the memory.\n  * [ENHANCEMENT] TSDB: Allow overlapping blocks by default.\n    --storage.tsdb.allow-overlapping-blocks now has no effect.\n  * [ENHANCEMENT] UI: Click to copy label-value pair from query\n    result to clipboard.\n  * [BUGFIX] TSDB: Turn off isolation for Head compaction to fix a\n    memory leak.\n  * [BUGFIX] TSDB: Fix 'invalid magic number 0' error on Prometheus\n    startup.\n  * [BUGFIX] PromQL: Properly close file descriptor when logging\n    unfinished queries.\n  * [BUGFIX] Agent: Fix validation of flag options and prevent WAL\n    from growing more than desired.\n- update to 2.38.0:\n  * [FEATURE]: Web: Add a /api/v1/format_query HTTP API endpoint\n    that allows pretty-formatting PromQL expressions.\n  * [FEATURE]: UI: Add support for formatting PromQL expressions in\n    the UI.\n  * [FEATURE]: DNS SD: Support MX records for discovering targets.\n  * [FEATURE]: Templates: Add toTime() template function that\n    allows converting sample timestamps to Go time.Time values.\n  * [ENHANCEMENT]: Kubernetes SD: Add\n    __meta_kubernetes_service_port_number meta label indicating the\n    service port number.\n  * [ENHANCEMENT]: Kubernetes SD: Add\n    __meta_kubernetes_pod_container_image meta label indicating the\n    container image.\n  * [ENHANCEMENT]: PromQL: When a query panics, also log the query\n    itself alongside the panic message.\n  * [ENHANCEMENT]: UI: Tweak colors in the dark theme to improve\n    the contrast ratio.\n  * [ENHANCEMENT]: Web: Speed up calls to /api/v1/rules by avoiding\n    locks and using atomic types instead.\n  * [ENHANCEMENT]: Scrape: Add a no-default-scrape-port feature\n    flag, which omits or removes any default HTTP (:80) or HTTPS\n    (:443) ports in the target's scrape address.\n  * [BUGFIX]: TSDB: In the WAL watcher metrics, expose the\n    type='exemplar' label instead of type='unknown' for exemplar\n    records.\n  * [BUGFIX]: TSDB: Fix race condition around allocating series IDs\n    during chunk snapshot loading.\n\n- Remove npm_licenses.tar.bz2 during 'make clean'\n\n- Remove web-ui archives during 'make clean'.\n\n  * [SECURITY] CVE-2022-41715: Limit memory used by parsing regexps\n    (bsc#1204023).\n- Fix uncontrolled resource consumption by updating Go to version\n  1.20.1 (CVE-2022-41723, bsc#1208298)","status":"published","published":"2024-09-17T07:48:51Z","modified":"2026-02-04T02:53:19.485214Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4319-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Update docker-buildx to v0.19.2. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.2\u003e.\n\n  Some notable changelogs from the last update:\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.19.0\u003e\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.18.0\u003e\n\n- Add a new toggle file /etc/docker/suse-secrets-enable which allows users to\n  disable the SUSEConnect integration with Docker (which creates special mounts\n  in /run/secrets to allow container-suseconnect to authenticate containers\n  with registries on registered hosts). bsc#1231348 bsc#1232999\n\n  In order to disable these mounts, just do\n\n    echo 0 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. In order to re-enable them, just do\n\n    echo 1 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. Docker will output information on startup to tell you\n  whether the SUSE secrets feature is enabled or not.\n\n- Disable docker-buildx builds for SLES. It turns out that build containers\n  with docker-buildx don't currently get the SUSE secrets mounts applied,\n  meaning that container-suseconnect doesn't work when building images.\n  bsc#1233819\n\n- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from\n  sysconfig a long time ago, and apparently this causes issues with systemd in\n  some cases.\n\n- Allow a parallel docker-stable RPM to exists in repositories.\n\n- Update to docker-buildx v0.17.1 to match standalone docker-buildx package we\n  are replacing. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.17.1\u003e\n\n- Allow users to disable SUSE secrets support by setting\n  DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)\n\n- Mark docker-buildx as required since classic 'docker build' has been\n  deprecated since Docker 23.0. (bsc#1230331)\n\n- Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate\n  package, but with docker-stable it will be necessary to maintain the packages\n  together and it makes more sense to have them live in the same OBS package.\n  (bsc#1230333)\n\n- Update to Docker 26.1.5-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2615\u003e\n  bsc#1230294\n\n- This update includes fixes for:\n  * CVE-2024-41110. bsc#1228324\n  * CVE-2023-47108. bsc#1217070 bsc#1229806\n  * CVE-2023-45142. bsc#1228553 bsc#1229806\n\n- Update to Docker 26.1.4-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2614\u003e\n\n- Update to Docker 26.1.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2610\u003e\n\n- Update --add-runtime to point to correct binary path.","status":"published","published":"2024-12-13T20:16:47Z","modified":"2026-02-04T03:03:32.94551Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4360-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Update docker-buildx to v0.19.2. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.2\u003e.\n\n  Some notable changelogs from the last update:\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.19.0\u003e\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.18.0\u003e\n\n- Add a new toggle file /etc/docker/suse-secrets-enable which allows users to\n  disable the SUSEConnect integration with Docker (which creates special mounts\n  in /run/secrets to allow container-suseconnect to authenticate containers\n  with registries on registered hosts). bsc#1231348 bsc#1232999\n\n  In order to disable these mounts, just do\n\n    echo 0 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. In order to re-enable them, just do\n\n    echo 1 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. Docker will output information on startup to tell you\n  whether the SUSE secrets feature is enabled or not.\n\n- Disable docker-buildx builds for SLES. It turns out that build containers\n  with docker-buildx don't currently get the SUSE secrets mounts applied,\n  meaning that container-suseconnect doesn't work when building images.\n  bsc#1233819\n\n- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from\n  sysconfig a long time ago, and apparently this causes issues with systemd in\n  some cases.\n\n- Allow a parallel docker-stable RPM to exists in repositories.\n\n- Update to docker-buildx v0.17.1 to match standalone docker-buildx package we\n  are replacing. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.17.1\u003e\n\n- Allow users to disable SUSE secrets support by setting\n  DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)\n\n- Mark docker-buildx as required since classic 'docker build' has been\n  deprecated since Docker 23.0. (bsc#1230331)\n\n- Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate\n  package, but with docker-stable it will be necessary to maintain the packages\n  together and it makes more sense to have them live in the same OBS package.\n  (bsc#1230333)\n\n- Update to Docker 26.1.5-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2615\u003e\n  bsc#1230294\n\n- This update includes fixes for:\n  * CVE-2024-41110. bsc#1228324\n  * CVE-2023-47108. bsc#1217070 bsc#1229806\n  * CVE-2023-45142. bsc#1228553 bsc#1229806\n\n- Update to Docker 26.1.4-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2614\u003e\n\n- Update to Docker 26.1.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2610\u003e\n\n- Update --add-runtime to point to correct binary path.","status":"published","published":"2024-12-17T14:35:54Z","modified":"2026-02-04T03:14:32.911188Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:20091-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- Update to containerd v1.7.21. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.21\n  Fixes CVE-2023-47108. bsc#1217070\n  Fixes CVE-2023-45142. bsc#1228553\n\n- Update to containerd v1.7.17. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.17\n\n- Update to containerd v1.7.16. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.16\n  CVE-2023-45288 bsc#1221400\n\n- Update to containerd v1.7.15. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.15\n\n- Update to containerd v1.7.14. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.14\n\n- Update to containerd v1.7.13. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.13\n\n- Update to containerd v1.7.12. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.12\n\n- Update to containerd v1.7.11. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.11\n  GHSA-jq35-85cj-fj4p bsc#1224323\n","status":"published","published":"2025-02-03T09:10:07Z","modified":"2026-03-23T04:48:52.304946Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20110-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Update docker-buildx to v0.19.2. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.2\u003e.\n\n  Some notable changelogs from the last update:\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.19.0\u003e\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.18.0\u003e\n\n- Add a new toggle file /etc/docker/suse-secrets-enable which allows users to\n  disable the SUSEConnect integration with Docker (which creates special mounts\n  in /run/secrets to allow container-suseconnect to authenticate containers\n  with registries on registered hosts). bsc#1231348 bsc#1232999\n\n  In order to disable these mounts, just do\n\n    echo 0 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. In order to re-enable them, just do\n\n    echo 1 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. Docker will output information on startup to tell you\n  whether the SUSE secrets feature is enabled or not.\n\n- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from\n  sysconfig a long time ago, and apparently this causes issues with systemd in\n  some cases.\n\n- Update to docker-buildx v0.17.1 to match standalone docker-buildx package we\n  are replacing. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.17.1\u003e\n\n- Add %{_sysconfdir}/audit/rules.d to filelist.\n\n- Update to Docker 26.1.5-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2615\u003e\n  bsc#1230294\n- This update includes fixes for:\n  * CVE-2024-41110. bsc#1228324\n  * CVE-2023-47108. bsc#1217070\n  * CVE-2023-45142. bsc#1228553\n","status":"published","published":"2025-02-03T09:19:38Z","modified":"2026-03-23T04:48:10.100758Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20259-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- This update includes fixes for:\n\n  * CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324)\n  * CVE-2023-47108: Fixed otelgrpc: DoS vulnerability in otelgrpc\n    (uncontrolled resource consumption) due to unbound cardinality\n    (bsc#1217070 bsc#1229806)\n  * CVE-2023-45142: Fixed otelhttp,otelhttptrace,otelrestful: DoS\n    vulnerability (bsc#1228553 bsc#1229806)\n\n- Update to Docker 27.5.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/27/#2741\u003e bsc#1237335\n\n- Update to docker-buildx 0.20.1. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.20.1\u003e\n\n- Update to Docker 27.4.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/27/#2741\u003e\n\n- Update to docker-buildx 0.19.3. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.3\u003e\n\n- Update to Docker 27.4.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/27/#274\u003e\n\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.2\u003e.\n\n  Some notable changelogs from the last update:\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.19.0\u003e\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.18.0\u003e\n\n- Update to Go 1.22.\n\n- Add a new toggle file /etc/docker/suse-secrets-enable which allows users to\n  disable the SUSEConnect integration with Docker (which creates special mounts\n  in /run/secrets to allow container-suseconnect to authenticate containers\n  with registries on registered hosts). bsc#1231348 bsc#1232999\n\n  In order to disable these mounts, just do\n\n    echo 0 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. In order to re-enable them, just do\n\n    echo 1 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. Docker will output information on startup to tell you\n  whether the SUSE secrets feature is enabled or not.\n\n- Disable docker-buildx builds for SLES. It turns out that build containers\n  with docker-buildx don't currently get the SUSE secrets mounts applied,\n  meaning that container-suseconnect doesn't work when building images.\n  bsc#1233819\n\n- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from\n  sysconfig a long time ago, and apparently this causes issues with systemd in\n  some cases.\n\n- Update to docker-buildx v0.17.1 to match standalone docker-buildx package we\n  are replacing. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.17.1\u003e\n\n- Mark docker-buildx as required since classic \"docker build\" has been\n  deprecated since Docker 23.0. bsc#1230331\n\n- Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate\n  package, but with docker-stable it will be necessary to maintain the packages\n  together and it makes more sense to have them live in the same OBS package.\n  bsc#1230333\n\n- Update to Docker 26.1.5-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2615\u003e\n  bsc#1230294\n\n","status":"published","published":"2025-03-31T16:54:17Z","modified":"2026-03-23T04:50:06.243016Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}