{"id":"CVE-2025-12816","aliases":["AZL-71125","DEBIAN-CVE-2025-12816","EUVD-2025-199630","GHSA-5gfm-wpxj-wjgq","SUSE-SU-2026:0628-1","SUSE-SU-2026:0630-1","SUSE-SU-2026:1008-1","SUSE-SU-2026:1013-1","SUSE-SU-2026:1035-1","SUSE-SU-2026:20232-1","UBUNTU-CVE-2025-12816","openSUSE-SU-2026:20177-1"],"status":"published","title":"CVE-2025-12816","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0058,"percentile":0.48149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2025-11-25T19:15:50Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"node-forge","fixed_in":["1.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-21"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-21"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0~dfsg-3","0.10.0~dfsg-3+deb11u1","0.10.0~dfsg-4","1.2.1~dfsg-1","1.2.1~dfsg-2","1.3.0~dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"node-forge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-120002.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-120002.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5-120002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-120002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.12-120002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.8-120002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5-120002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5-120002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.24-120002.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-150002.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5-150002.3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.12-150002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.8-150002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5-150002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.24-150002.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150002.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.24-150002.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150000.3.67.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-150000.1.90.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.5~dfsg-2","0.9.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0~dfsg-3","1.2.1~dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"digital bazaar","product":"forge"},{"vendor":"digital bazaar","product":"node-forge"},{"vendor":"digitalbazaar","product":"forge"}],"references":[{"url":"https://www.npmjs.com/package/node-forge","tags":["Product","web","report"]},{"url":"https://github.com/digitalbazaar/forge/pull/1124","tags":["Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/digitalbazaar/forge","tags":["Product","package","report"]},{"url":"https://kb.cert.org/vuls/id/521113","tags":["third-party-advisory","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq","tags":["third-party-advisory","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://www.kb.cert.org/vuls/id/521113","tags":["Third Party Advisory","web","report"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5gfm-wpxj-wjgq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12816","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12816.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-12816","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1247644","tags":["report"]},{"url":"https://bugzilla.suse.com/1247721","tags":["report"]},{"url":"https://bugzilla.suse.com/1248848","tags":["report"]},{"url":"https://bugzilla.suse.com/1249400","tags":["report"]},{"url":"https://bugzilla.suse.com/1249532","tags":["report"]},{"url":"https://bugzilla.suse.com/1250940","tags":["report"]},{"url":"https://bugzilla.suse.com/1250976","tags":["report"]},{"url":"https://bugzilla.suse.com/1250981","tags":["report"]},{"url":"https://bugzilla.suse.com/1251044","tags":["report"]},{"url":"https://bugzilla.suse.com/1251138","tags":["report"]},{"url":"https://bugzilla.suse.com/1251995","tags":["report"]},{"url":"https://bugzilla.suse.com/1253174","tags":["report"]},{"url":"https://bugzilla.suse.com/1253282","tags":["report"]},{"url":"https://bugzilla.suse.com/1253347","tags":["report"]},{"url":"https://bugzilla.suse.com/1253659","tags":["report"]},{"url":"https://bugzilla.suse.com/1253738","tags":["report"]},{"url":"https://bugzilla.suse.com/1253966","tags":["report"]},{"url":"https://bugzilla.suse.com/1254478","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1255588","tags":["report"]},{"url":"https://bugzilla.suse.com/1255781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253004","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261008-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257329","tags":["report"]},{"url":"https://bugzilla.suse.com/1257442","tags":["report"]},{"url":"https://bugzilla.suse.com/1257841","tags":["report"]},{"url":"https://bugzilla.suse.com/1257897","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261013-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1254589","tags":["report"]},{"url":"https://bugzilla.suse.com/1256803","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261035-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213308","tags":["report"]},{"url":"https://bugzilla.suse.com/1214568","tags":["report"]},{"url":"https://bugzilla.suse.com/1214569","tags":["report"]},{"url":"https://bugzilla.suse.com/1216711","tags":["report"]},{"url":"https://bugzilla.suse.com/1217755","tags":["report"]},{"url":"https://bugzilla.suse.com/1220899","tags":["report"]},{"url":"https://bugzilla.suse.com/1221950","tags":["report"]},{"url":"https://bugzilla.suse.com/1223368","tags":["report"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1228577","tags":["report"]},{"url":"https://bugzilla.suse.com/1230876","tags":["report"]},{"url":"https://bugzilla.suse.com/1232125","tags":["report"]},{"url":"https://bugzilla.suse.com/1233496","tags":["report"]},{"url":"https://bugzilla.suse.com/1236066","tags":["report"]},{"url":"https://bugzilla.suse.com/1236799","tags":["report"]},{"url":"https://bugzilla.suse.com/1237536","tags":["report"]},{"url":"https://bugzilla.suse.com/1238481","tags":["report"]},{"url":"https://bugzilla.suse.com/1239636","tags":["report"]},{"url":"https://bugzilla.suse.com/1240565","tags":["report"]},{"url":"https://bugzilla.suse.com/1241013","tags":["report"]},{"url":"https://bugzilla.suse.com/1243241","tags":["report"]},{"url":"https://bugzilla.suse.com/1243679","tags":["report"]},{"url":"https://bugzilla.suse.com/1243768","tags":["report"]},{"url":"https://bugzilla.suse.com/1243808","tags":["report"]},{"url":"https://bugzilla.suse.com/1243876","tags":["report"]},{"url":"https://bugzilla.suse.com/1243881","tags":["report"]},{"url":"https://bugzilla.suse.com/1244177","tags":["report"]},{"url":"https://bugzilla.suse.com/1244542","tags":["report"]},{"url":"https://bugzilla.suse.com/1244648","tags":["report"]},{"url":"https://bugzilla.suse.com/1244724","tags":["report"]},{"url":"https://bugzilla.suse.com/1245241","tags":["report"]},{"url":"https://bugzilla.suse.com/1245307","tags":["report"]},{"url":"https://bugzilla.suse.com/1245405","tags":["report"]},{"url":"https://bugzilla.suse.com/1245766","tags":["report"]},{"url":"https://bugzilla.suse.com/1246421","tags":["report"]},{"url":"https://bugzilla.suse.com/1246981","tags":["report"]},{"url":"https://bugzilla.suse.com/1247038","tags":["report"]},{"url":"https://bugzilla.suse.com/1248741","tags":["report"]},{"url":"https://bugzilla.suse.com/1248804","tags":["report"]},{"url":"https://bugzilla.suse.com/1249502","tags":["report"]},{"url":"https://bugzilla.suse.com/1251864","tags":["report"]},{"url":"https://bugzilla.suse.com/1252937","tags":["report"]},{"url":"https://bugzilla.suse.com/1253024","tags":["report"]},{"url":"https://bugzilla.suse.com/1253068","tags":["report"]},{"url":"https://bugzilla.suse.com/1253158","tags":["report"]},{"url":"https://bugzilla.suse.com/1253322","tags":["report"]},{"url":"https://bugzilla.suse.com/1253501","tags":["report"]},{"url":"https://bugzilla.suse.com/1253773","tags":["report"]},{"url":"https://bugzilla.suse.com/1255298","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27830","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620232-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-12816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12816","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-12816","title":"CVE-2025-12816","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T19:15:50.243Z","modified":"2025-11-25T21:04:09.432Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-199630","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T19:15:50Z","modified":"2025-11-25T21:04:09Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:12.807834Z"}],"ghsa":[{"id":"GHSA-5gfm-wpxj-wjgq","title":"node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization","description":"### Summary\n\nCVE-2025-12816 has been reserved by CERT/CC\n\n**Description**\nAn Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.\n\n\n### Details\n\nA critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within `forge/lib/asn1.js`. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encoding of ASN.1, is what cryptographic code expects when verifying signatures, and the exact bytes and structure must match the schema used to compute and verify the signature. After deserializing DER, Forge uses static ASN.1 validation schemas to locate the signed data or public key, compute digests over the exact bytes required, and feed digest and signature fields into cryptographic primitives.\n\nThis vulnerability allows a specially crafted ASN.1 object to desynchronize the validator on optional boundaries, causing a malformed optional field to be semantically reinterpreted as the subsequent mandatory structure. This manifests as logic bypasses in cryptographic algorithms and protocols with optional security features (such as PKCS#12, where MACs are treated as absent) and semantic interpretation conflicts in strict protocols (such as X.509, where fields are read as the wrong type).\n\n### Impact\n\nThis flaw allows an attacker to desynchronize the validator, allowing critical components like digital signatures or integrity checks to be skipped or validated against attacker-controlled data.\n\nThis vulnerability impacts the `ans1.validate` function in `node-forge` before patched version `1.3.2`.\nhttps://github.com/digitalbazaar/forge/blob/main/lib/asn1.js.\n\nThe following components in `node-forge` are impacted.\n[lib/asn1.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153)\n[lib/x509.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667)\n[lib/pkcs12.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328)\n[lib/pkcs7.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90)\n[lib/rsa.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167)\n[lib/pbe.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363)\n[lib/ed25519.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81)\n\nAny downstream application using these components is impacted.\n\nThese components may be leveraged by downstream applications in ways that enable full compromise of integrity, leading to potential availability and confidentiality compromises.","status":"published","published":"2025-11-26T22:07:19Z","modified":"2025-11-26T22:07:20Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2025-12816","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T20:15:58.87Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:11:46.94029Z"}],"osv":[{"id":"CVE-2025-12816","title":"CVE-2025-12816","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T19:15:50.243Z","modified":"2026-10-28T02:30:45.092494668Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"DEBIAN-CVE-2025-12816","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T20:15:58.87Z","modified":"2026-08-27T23:05:22.836872045Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-5gfm-wpxj-wjgq","title":"node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization","description":"### Summary\n\nCVE-2025-12816 has been reserved by CERT/CC\n\n**Description**\nAn Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.\n\n\n### Details\n\nA critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within `forge/lib/asn1.js`. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encoding of ASN.1, is what cryptographic code expects when verifying signatures, and the exact bytes and structure must match the schema used to compute and verify the signature. After deserializing DER, Forge uses static ASN.1 validation schemas to locate the signed data or public key, compute digests over the exact bytes required, and feed digest and signature fields into cryptographic primitives.\n\nThis vulnerability allows a specially crafted ASN.1 object to desynchronize the validator on optional boundaries, causing a malformed optional field to be semantically reinterpreted as the subsequent mandatory structure. This manifests as logic bypasses in cryptographic algorithms and protocols with optional security features (such as PKCS#12, where MACs are treated as absent) and semantic interpretation conflicts in strict protocols (such as X.509, where fields are read as the wrong type).\n\n### Impact\n\nThis flaw allows an attacker to desynchronize the validator, allowing critical components like digital signatures or integrity checks to be skipped or validated against attacker-controlled data.\n\nThis vulnerability impacts the `ans1.validate` function in `node-forge` before patched version `1.3.2`.\nhttps://github.com/digitalbazaar/forge/blob/main/lib/asn1.js.\n\nThe following components in `node-forge` are impacted.\n[lib/asn1.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153)\n[lib/x509.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667)\n[lib/pkcs12.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328)\n[lib/pkcs7.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90)\n[lib/rsa.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167)\n[lib/pbe.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363)\n[lib/ed25519.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81)\n\nAny downstream application using these components is impacted.\n\nThese components may be leveraged by downstream applications in ways that enable full compromise of integrity, leading to potential availability and confidentiality compromises.","status":"published","published":"2025-11-26T22:07:19Z","modified":"2026-09-10T03:50:30.566175753Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"UBUNTU-CVE-2025-12816","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T20:15:00Z","modified":"2025-11-27T08:15:19.343763Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-71125","title":"CVE-2025-12816 affecting package reaper for versions less than 3.1.1-21","description":"An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.","status":"published","published":"2025-11-25T20:15:58Z","modified":"2026-04-21T04:36:31.942801Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"openSUSE-SU-2026:20177-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\nUpdate to version 3.5.0:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global (bsc#1257329).\n- CVE-2025-12816: interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588).\n\nOther updates and bugfixes:\n\n- Update to 3.5.0 (jsc#PED-13824):\n\n  * [FEATURE] Remote-write: Add support for Azure Workload Identity\n    as an authentication method for the receiver.\n  * [FEATURE] PromQL: Add first_over_time(...) and\n    ts_of_first_over_time(...) behind feature flag.\n  * [FEATURE] Federation: Add support for native histograms with\n    custom buckets (NHCB).\n  * [ENHANCEMENT] PromQL: Add warn-level annotations for counter\n    reset conflicts in certain histogram operations.\n  * [ENHANCEMENT] UI: Add scrape interval and scrape timeout to\n    targets page.\n\n- Update to 3.4.0:\n\n  * Add unified AWS service discovery for ec2, lightsail and ecs services.\n  * [FEATURE] Native histograms are now a stable, but optional\n    feature.\n  * [FEATURE] UI: Show detailed relabeling steps for each\n    discovered target.\n  * [ENHANCEMENT] Alerting: Add \"unknown\" state for alerting rules\n    that haven't been evaluated yet.\n  * [BUGFIX] Scrape: Fix a bug where scrape cache would not be\n    cleared on startup.\n\n- Update to 3.3.0:\n\n  * [FEATURE] Spring Boot 3.3 includes support for the Prometheus\n    Client 1.x.\n  * [ENHANCEMENT] Dependency management for Dropwizard Metrics has\n    been removed.\n\n- Update to 3.2.0:\n\n  * [FEATURE] OAuth2: support jwt-bearer grant-type (RFC7523 3.1).\n  * [ENHANCEMENT] PromQL: Reconcile mismatched NHCB bounds in Add\n    and Sub.\n  * [BUGFIX] TSDB: Native Histogram Custom Bounds with a NaN\n    threshold are now rejected.\n\n- Update to 3.1.0:\n\n  * [FEATURE] Remote-write 2 (receiving): Update to 2.0-rc.4 spec.\n    \"created timestamp\" (CT) is now called \"start timestamp\" (ST).\n  * [BUGFIX] Mixin: Add static UID to the remote-write dashboard.\n\n- Update to 3.0.1:\n\n  * [BUGFIX] Promql: Make subqueries left open.\n  * [BUGFIX] Fix memory leak when query log is enabled.\n  * [BUGFIX] Support utf8 names on /v1/label/:name/values endpoint.\n\n- Update to 3.0.0:\n\n  * [CHANGE] Deprecated feature flags removed.\n  * [FEATURE] New UI.\n  * [FEATURE] Remote Write 2.0.\n  * [FEATURE] OpenTelemetry Support.\n  * [FEATURE] UTF-8 support is now stable and enabled by default.\n  * [FEATURE] OTLP Ingestion.\n  * [FEATURE] Native Histograms.\n  * [BUGFIX] PromQL: Fix count_values for histograms.\n  * [BUGFIX] TSDB: Fix race on stale values in headAppender.\n  * [BUGFIX] UI: Fix selector / series formatting for empty metric\n    names.\n\n- Update to 2.55.0:\n\n  * [FEATURE] PromQL: Add `last_over_time` function.\n  * [FEATURE] Agent: Add `prometheus_agent_build_info` metric.\n  * [ENHANCEMENT] PromQL: Optimise `group()` and `group by()`.\n  * [ENHANCEMENT] TSDB: Reduce memory usage when loading blocks.\n  * [BUGFIX] Scrape: Fix a bug where a target could be scraped\n    multiple times.\n\n- Update to 2.54.0:\n\n  * [CHANGE] Remote-Write: highest_timestamp_in_seconds and\n    queue_highest_sent_timestamp_seconds metrics now initialized to\n    0.\n  * [CHANGE] API: Split warnings from info annotations in API\n    response.\n  * [FEATURE] Remote-Write: Version 2.0 experimental, plus metadata\n    in WAL via feature flag.\n  * [FEATURE] PromQL: add limitk() and limit_ratio() aggregation\n    operators.\n  * [ENHANCEMENT] PromQL: Accept underscores in literal numbers.\n  * [ENHANCEMENT] PromQL: float literal numbers and durations are\n    now interchangeable (experimental).\n  * [ENHANCEMENT] PromQL (experimental native histograms): Optimize\n    histogram_count and histogram_sum functions.\n  * [BUGFIX] PromQL: Fix various issues with native histograms.\n  * [BUGFIX] TSDB: Fix race on stale values in headAppender.\n  * [BUGFIX] OTLP receiver: Allow colons in non-standard units.\n\n","status":"published","published":"2026-02-05T10:44:24Z","modified":"2026-03-23T04:54:46.38484Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0628-1","title":"Security update 5.1.2 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization around source building\n\ngolang-github-boynux-squid_exporter:\n\n- Update to version 1.13.0 (jsc#PED-14971)\n  - Add support for squid-internal-mgr path for metrics.\n- Update to version 1.12.0\n  - Add TLS and basic authentication support for the web interface.\n- Update to version 1.11.0\n  - Allow adding custom labels to all metrics.\n- Update to version 1.10.0\n  - Add ability to configure the exporter using environment variables.\n  - Add support for Squid 6\n  - Add `squid_up` metric\n  - Add `squid_scrape_duration_seconds` metric\n  - Add `squid_scrape_error` metric\n- Update to version 1.9.0\n  - Add `process_open_fds` metric to monitor open file descriptors.\n  - Use `CAP_DAC_READ_SEARCH` capability to allow reading process information without running as root.\n- Update to version 1.8.0\n  - Add various service time metrics to provide more detailed performance data.\n- Update to version 1.7.0\n  - Add support for basic authentication against the Squid proxy.\n  - Fix `squid_client_http_requests_total` metric\n- Upstream changes for v1.9.0:\n  - Use `CAP_DAC_READ_SEARCH` capability to allow\n    reading process information without running as root.\n- Upstream changes for v1.8.0:\n  - Add various service time metrics to provide more detailed\n    performance data.\n- Upstream changes for v1.7.0:\n    Squid proxy.Update to version 1.10.0\n  - Add ability to configure the exporter using environment\n    variables.\n  - Add `process_open_fds` metric to monitor open file descriptors.\n  - Use `CAP_DAC_READ_SEARCH` capability to allow reading process\n    information without running as root.\n  - Add various service time metrics to provide more detailed\n    performance data.\n  - Add support for basic authentication against the Squid proxy.\n- Use current distro go default version.  Use auto-versioning\n  on SUSE as well.\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Build without apparmor for openSUSE Leap 16, SLES 16 or newer\n- Update to version 1.0.10\n  * Update github.com/prometheus/client_golang to 1.21.1\n  * Update github.com/prometheus/common to 0.63.0\n  * Update github.com/prometheus/exporter-toolkit to 0.14.0\n- Update to version 1.0.9\n  * Update github.com/prometheus/client_golang to 1.20.4\n  * Update github.com/prometheus/common to 0.59.1\n  * Update github.com/prometheus/exporter-toolkit to 0.13.0\n  * Migrate logging to log/slog\n  * Fix signal handler logging\n\ngolang-github-prometheus-alertmanager:\n\n- Require gcc11-c++ for building with SLE 12\n\ngolang-github-prometheus-node_exporter:\n\n- Require gcc11-c++ for building with SLE 12\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Update to 3.5.0 (jsc#PED-13824):\n  This is a Long-Term Support (LTS) release.\n  * [FEATURE] Remote-write: Add support for Azure Workload Identity as an authentication method for the receiver.\n  * [FEATURE] PromQL: Add first_over_time(...) and ts_of_first_over_time(...) behind feature flag.\n  * [FEATURE] Federation: Add support for native histograms with custom buckets (NHCB).\n  * [ENHANCEMENT] PromQL: Add warn-level annotations for counter reset conflicts in certain histogram operations.\n  * [ENHANCEMENT] UI: Add scrape interval and scrape timeout to targets page.\n- Update to 3.4.0:\n  * [FEATURE] SD: Add unified AWS service discovery for ec2, lightsail and ecs services.\n  * [FEATURE] Native histograms are now a stable, but optional feature.\n  * [FEATURE] UI: Show detailed relabeling steps for each discovered target.\n  * [ENHANCEMENT] Alerting: Add 'unknown' state for alerting rules that haven't been evaluated yet.\n  * [BUGFIX] Scrape: Fix a bug where scrape cache would not be cleared on startup.\n- Update to 3.3.0:\n  * [FEATURE] Spring Boot 3.3 includes support for the Prometheus Client 1.x.\n  * [ENHANCEMENT] Dependency management for Dropwizard Metrics has been removed.\n- Update to 3.2.0:\n  * [FEATURE] OAuth2: support jwt-bearer grant-type (RFC7523 3.1).\n  * [ENHANCEMENT] PromQL: Reconcile mismatched NHCB bounds in Add\n    and Sub.\n  * [BUGFIX] TSDB: Native Histogram Custom Bounds with a NaN\n    threshold are now rejected.\n- Update to 3.1.0:\n  * [FEATURE] Remote-write 2 (receiving): Update to 2.0-rc.4 spec.\n    'created timestamp' (CT) is now called 'start timestamp' (ST).\n  * [BUGFIX] Mixin: Add static UID to the remote-write dashboard.\n- Update to 3.0.1:\n  * [BUGFIX] Promql: Make subqueries left open.\n  * [BUGFIX] Fix memory leak when query log is enabled.\n  * [BUGFIX] Support utf8 names on /v1/label/:name/values endpoint.\n- Update to 3.0.0:\n  This release includes new features such as a brand new UI and\n  UTF-8 support enabled by default.\n  * [CHANGE] Deprecated feature flags removed.\n  * [FEATURE] New UI.\n  * [FEATURE] Remote Write 2.0.\n  * [FEATURE] OpenTelemetry Support.\n  * [FEATURE] UTF-8 support is now stable and enabled by default.\n  * [FEATURE] OTLP Ingestion.\n  * [FEATURE] Native Histograms.\n  * [BUGFIX] PromQL: Fix count_values for histograms.\n  * [BUGFIX] TSDB: Fix race on stale values in headAppender.\n  * [BUGFIX] UI: Fix selector / series formatting for empty metric\n    names.\n- Update to 2.55.0:\n  * [FEATURE] PromQL: Add `last_over_time` function.\n  * [FEATURE] Agent: Add `prometheus_agent_build_info` metric.\n  * [ENHANCEMENT] PromQL: Optimise `group()` and `group by()`.\n  * [ENHANCEMENT] TSDB: Reduce memory usage when loading blocks.\n  * [BUGFIX] Scrape: Fix a bug where a target could be scraped\n    multiple times.\n- Update to 2.54.0:\n  This release brings a release candidate of a major new version of\n  Remote Write: 2.0.\n  * [CHANGE] Remote-Write: highest_timestamp_in_seconds and queue_highest_sent_timestamp_seconds metrics now initialized\n    to 0.\n  * [CHANGE] API: Split warnings from info annotations in API response.\n  * [FEATURE] Remote-Write: Version 2.0 experimental, plus metadata\n    in WAL via feature flag.\n  * [FEATURE] PromQL: add limitk() and limit_ratio() aggregation\n    operators.\n  * [ENHANCEMENT] PromQL: Accept underscores in literal numbers.\n  * [ENHANCEMENT] PromQL: float literal numbers and durations are\n    now interchangeable (experimental).\n  * [ENHANCEMENT] PromQL (experimental native histograms): Optimize\n    histogram_count and histogram_sum functions.\n  * [BUGFIX] PromQL: Fix various issues with native histograms.\n  * [BUGFIX] OTLP receiver: Allow colons in non-standard units.\n- Require gcc11-c++ for building with SLE 12\n\ngrafana:\n\n- CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n\nmgr-push:\n\n- Version 5.1.5-0\n  * Non-customer-facing optimization and update\n\nprometheus-blackbox_exporter:\n\n- Non-customer-facing optimization and update\n\nrhnlib:\n\n- Version 5.1.4-0\n  * Non-customer-facing optimization and update  \n\nspacecmd:\n\n- Version 5.1.12-0\n  * Fix spacecmd binary file upload (bsc#1253659)\n  * Fix typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to int (bsc#1251995)\n  * Fix methods in api namespace in spacecmd (bsc#1249532)\n  * Make caching code Py 2.7 compatible\n  * Use JSON instead of pickle for spacecmd\n    cache (bsc#1227579)\n  * Python 2.7 cannot re-raise exceptions\n\nspacewalk-client-tools:\n\n- Version 5.1.8-0\n  * Non-customer-facing optimization and update\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.1.5-0\n  * Non-customer-facing optimization and update\n\nuyuni-common-libs:\n\n- Version 5.1.5-0\n  * Non-customer-facing optimization and update\n\nuyuni-tools:\n\n- Version 5.1.24-0\n  * Actually use the --dbupgrade-tag parameter when computing the\n    image URL (bsc#1249400)\n  * Handle CA files with symlinks during migration (bsc#1251044)\n  * Adjust traefik exposed configuration for chart v27+ (bsc#1247721)\n  * Fix systemd object initialization in server rename. (bsc#1250981)\n  * Add SSL secrets to the db setup container during migration. (bsc#1250976)\n  * Fix images handling in mgrpxy support ptf (bsc#1250940)\n  * Fix helm upgrade parameters (bsc#1253966)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Move the SSL checks at the beginning of the migration\n  * Remove cgroup mount for podman containers (bsc#1253347)\n  * Convert the traefik install time to local time (bsc#1251138)\n  * During migration, krb5.conf.d should be copied in /etc/rhn (bsc#1254478)\n  * Read env var from http conf file (bsc#1253282)\n  * Add --registry-host, --registry-user and --registry-password\n    to pull images from an authenticate registry\n  * Deprecate --registry\n  * Unify backup create and restore dryrun option case\n  * Fix calling of squid -z in mgrpxy cache clear (bsc#1247644)\n  * Always start database container even if enabled\n  * Remove extra ipv6 mapping and nftables workaround (bsc#1248848)\n  * Remove old PostgreSQL exporter environment file before migration\n  * Support config command parse correctly supportconfig output (bsc#1255781)\n\n","status":"published","published":"2026-02-25T09:44:32Z","modified":"2026-02-26T16:16:55.939079Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0630-1","title":"Security update 5.1.2 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot:\n\n- Update to version 1.1.0\n  * Retry DHCP requests up to 3 times (bsc#1253004) \n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization around source building\n\ngolang-github-boynux-squid_exporter:\n\n- Update to version 1.13.0 (jsc#PED-14971)\n  - Add support for squid-internal-mgr path for metrics.\n- Update to version 1.12.0\n  - Add TLS and basic authentication support for the web interface.\n- Update to version 1.11.0\n  - Allow adding custom labels to all metrics.\n- Update to version 1.10.0\n  - Add ability to configure the exporter using environment variables.\n  - Add support for Squid 6\n  - Add `squid_up` metric\n  - Add `squid_scrape_duration_seconds` metric\n  - Add `squid_scrape_error` metric\n- Update to version 1.9.0\n  - Add `process_open_fds` metric to monitor open file descriptors.\n  - Use `CAP_DAC_READ_SEARCH` capability to allow reading process information without running as root.\n- Update to version 1.8.0\n  - Add various service time metrics to provide more detailed performance data.\n- Update to version 1.7.0\n  - Add support for basic authentication against the Squid proxy.\n  - Fix `squid_client_http_requests_total` metric\n- Upstream changes for v1.9.0:\n  - Use `CAP_DAC_READ_SEARCH` capability to allow\n    reading process information without running as root.\n- Upstream changes for v1.8.0:\n  - Add various service time metrics to provide more detailed\n    performance data.\n- Upstream changes for v1.7.0:\n    Squid proxy.Update to version 1.10.0\n  - Add ability to configure the exporter using environment\n    variables.\n  - Add `process_open_fds` metric to monitor open file descriptors.\n  - Use `CAP_DAC_READ_SEARCH` capability to allow reading process\n    information without running as root.\n  - Add various service time metrics to provide more detailed\n    performance data.\n  - Add support for basic authentication against the Squid proxy.\n- Use current distro go default version.  Use auto-versioning\n  on SUSE as well.\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Build without apparmor for openSUSE Leap 16, SLES 16 or newer\n- Require Go 1.23 for building\n- Update to version 1.0.10\n  * Update github.com/prometheus/client_golang to 1.21.1\n  * Update github.com/prometheus/common to 0.63.0\n  * Update github.com/prometheus/exporter-toolkit to 0.14.0\n- Update to version 1.0.9\n  * Update github.com/prometheus/client_golang to 1.20.4\n  * Update github.com/prometheus/common to 0.59.1\n  * Update github.com/prometheus/exporter-toolkit to 0.13.0\n  * Migrate logging to log/slog\n  * Fix signal handler logging\n\ngolang-github-prometheus-alertmanager:\n\n- Non-customer-facing optimization around source building\n\ngolang-github-prometheus-node_exporter:\n\n- Non-customer-facing optimization around source building\n\ngolang-github-prometheus-prometheus:\n\n- CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n- Update to 3.5.0 (jsc#PED-13824):\n  This is a Long-Term Support (LTS) release.\n  * [FEATURE] Remote-write: Add support for Azure Workload Identity as an authentication method for the receiver.\n  * [FEATURE] PromQL: Add first_over_time(...) and ts_of_first_over_time(...) behind feature flag.\n  * [FEATURE] Federation: Add support for native histograms with custom buckets (NHCB).\n  * [ENHANCEMENT] PromQL: Add warn-level annotations for counter reset conflicts in certain histogram operations.\n  * [ENHANCEMENT] UI: Add scrape interval and scrape timeout to targets page.\n- Update to 3.4.0:\n  * [FEATURE] SD: Add unified AWS service discovery for ec2, lightsail and ecs services.\n  * [FEATURE] Native histograms are now a stable, but optional feature.\n  * [FEATURE] UI: Show detailed relabeling steps for each discovered target.\n  * [ENHANCEMENT] Alerting: Add 'unknown' state for alerting rules that haven't been evaluated yet.\n  * [BUGFIX] Scrape: Fix a bug where scrape cache would not be cleared on startup.\n- Update to 3.3.0:\n  * [FEATURE] Spring Boot 3.3 includes support for the Prometheus Client 1.x.\n  * [ENHANCEMENT] Dependency management for Dropwizard Metrics has been removed.\n- Update to 3.2.0:\n  * [FEATURE] OAuth2: support jwt-bearer grant-type (RFC7523 3.1).\n  * [ENHANCEMENT] PromQL: Reconcile mismatched NHCB bounds in Add\n    and Sub.\n  * [BUGFIX] TSDB: Native Histogram Custom Bounds with a NaN\n    threshold are now rejected.\n- Update to 3.1.0:\n  * [FEATURE] Remote-write 2 (receiving): Update to 2.0-rc.4 spec.\n    'created timestamp' (CT) is now called 'start timestamp' (ST).\n  * [BUGFIX] Mixin: Add static UID to the remote-write dashboard.\n- Update to 3.0.1:\n  * [BUGFIX] Promql: Make subqueries left open.\n  * [BUGFIX] Fix memory leak when query log is enabled.\n  * [BUGFIX] Support utf8 names on /v1/label/:name/values endpoint.\n- Update to 3.0.0:\n  This release includes new features such as a brand new UI and\n  UTF-8 support enabled by default.\n  * [CHANGE] Deprecated feature flags removed.\n  * [FEATURE] New UI.\n  * [FEATURE] Remote Write 2.0.\n  * [FEATURE] OpenTelemetry Support.\n  * [FEATURE] UTF-8 support is now stable and enabled by default.\n  * [FEATURE] OTLP Ingestion.\n  * [FEATURE] Native Histograms.\n  * [BUGFIX] PromQL: Fix count_values for histograms.\n  * [BUGFIX] TSDB: Fix race on stale values in headAppender.\n  * [BUGFIX] UI: Fix selector / series formatting for empty metric\n    names.\n- Update to 2.55.0:\n  * [FEATURE] PromQL: Add `last_over_time` function.\n  * [FEATURE] Agent: Add `prometheus_agent_build_info` metric.\n  * [ENHANCEMENT] PromQL: Optimise `group()` and `group by()`.\n  * [ENHANCEMENT] TSDB: Reduce memory usage when loading blocks.\n  * [BUGFIX] Scrape: Fix a bug where a target could be scraped\n    multiple times.\n- Update to 2.54.0:\n  This release brings a release candidate of a major new version of\n  Remote Write: 2.0.\n  * [CHANGE] Remote-Write: highest_timestamp_in_seconds and queue_highest_sent_timestamp_seconds metrics now initialized to 0.\n  * [CHANGE] API: Split warnings from info annotations in API response.\n  * [FEATURE] Remote-Write: Version 2.0 experimental, plus metadata\n    in WAL via feature flag.\n  * [FEATURE] PromQL: add limitk() and limit_ratio() aggregation\n    operators.\n  * [ENHANCEMENT] PromQL: Accept underscores in literal numbers.\n  * [ENHANCEMENT] PromQL: float literal numbers and durations are\n    now interchangeable (experimental).\n  * [ENHANCEMENT] PromQL (experimental native histograms): Optimize\n    histogram_count and histogram_sum functions.\n  * [BUGFIX] PromQL: Fix various issues with native histograms.\n  * [BUGFIX] OTLP receiver: Allow colons in non-standard units.\n\ngrafana:\n\n- CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n\nmgr-push:\n\n- Version 5.1.5-0\n  * Non-customer-facing optimization and update\n\nprometheus-blackbox_exporter:\n\n* Non-customer-facing optimization and update\n\nrhnlib:\n\n- Version 5.1.4-0\n  * Non-customer-facing optimization and update\n\nspacecmd:\n\n- Version 5.1.12-0\n  * Fix spacecmd binary file upload (bsc#1253659)\n  * Fix typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to int (bsc#1251995)\n  * Fix methods in api namespace in spacecmd (bsc#1249532)\n  * Make caching code Py 2.7 compatible\n  * Use JSON instead of pickle for spacecmd cache (bsc#1227579)\n  * Python 2.7 cannot re-raise exceptions\n\nspacewalk-client-tools:\n\n- Version 5.1.8-0\n  * Non-customer-facing optimization and update\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.1.5-0\n  * Non-customer-facing optimization and update\n\nuyuni-common-libs:\n\n- Version 5.1.5-0\n  * Non-customer-facing optimization and update\n\nuyuni-tools:\n\n- Version 5.1.24-0\n  * Actually use the --dbupgrade-tag parameter when computing the\n    image URL (bsc#1249400)\n  * Handle CA files with symlinks during migration (bsc#1251044)\n  * Adjust traefik exposed configuration for chart v27+ (bsc#1247721)\n  * Fix systemd object initialization in server rename. (bsc#1250981)\n  * Add SSL secrets to the db setup container during migration. (bsc#1250976)\n  * Fix images handling in mgrpxy support ptf (bsc#1250940)\n  * Fix helm upgrade parameters (bsc#1253966)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Move the SSL checks at the beginning of the migration\n  * Remove cgroup mount for podman containers (bsc#1253347)\n  * Convert the traefik install time to local time (bsc#1251138)\n  * During migration, krb5.conf.d should be copied in /etc/rhn (bsc#1254478)\n  * Read env var from http conf file (bsc#1253282)\n  * Add --registry-host, --registry-user and --registry-password\n    to pull images from an authenticate registry\n  * Deprecate --registry\n  * Unify backup create and restore dryrun option case\n  * Fix calling of squid -z in mgrpxy cache clear (bsc#1247644)\n  * Always start database container even if enabled\n  * Remove extra ipv6 mapping and nftables workaround (bsc#1248848)\n  * Remove old PostgreSQL exporter environment file before migration\n  * Support config command parse correctly supportconfig output (bsc#1255781)\n\n","status":"published","published":"2026-02-25T09:46:12Z","modified":"2026-02-26T16:17:01.946184Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:1008-1","title":"Security update for Prometheus ","description":"This update for Prometheus fixes the following issues:\n\ngolang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter: \n\n- Internal changes to fix build issues with no impact for customers   \n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations.\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times.\n","status":"published","published":"2026-03-25T10:07:27Z","modified":"2026-03-26T09:00:27.331237Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1013-1","title":"Security update 5.0.7 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot:\n\n- Version update to 1.1.0:\n\n  * Retry DHCP requests up to 3 times (bsc#1253004)\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization and update\n\ngolang-github-boynux-squid_exporter:\n\n- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):\n\n  * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path\n  * Added TLS and Basic Authentication to the exporter’s web interface\n  * Added support for the exporter to authenticate against the Squid proxy itself\n  * Allow the gathering of process information without requiring root privileges\n  * The exporter can now be configured using environment variables\n  * Added support for custom labels to all exported metrics for better data filtering\n  * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred\n  * Added 'service time' metrics to analyze proxy speed and performance.\n  * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks\n  * Corrected the squid_client_http_requests_total metric to ensure accurate reporting\n\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Version update from 1.0.8 to 1.0.10:\n\n  * Updated github.com/prometheus/client_golang to 1.21.1\n  * Updated github.com/prometheus/common to 0.63.0\n  * Updated github.com/prometheus/exporter-toolkit to 0.14.0\n  * Fixed signal handler logging\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times\n\ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n  * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n\n- Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:\n \n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Non-customer-facing optimization and update\n\nspacecmd:\n\n- Version update to 5.0.15:\n\n  * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to integer values (bsc#1251995)\n  * Fixed spacecmd binary file upload (bsc#1253659)\n\nuyuni-tools:\n\n- Version update to 0.1.38:\n\n  * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Ignore supportconfig errors (bsc#1255781)\n  * Bumped the default image tag to 5.0.7\n  * Removed cgroup mount for podman containers (bsc#1253347)\n  * Registry flag can be a string (bsc#1254589)\n  * Use static supportconfig name to avoid dynamic search (bsc#1257941)\n\n","status":"published","published":"2026-03-25T10:11:52Z","modified":"2026-03-26T09:00:33.541819Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1035-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-03-25T10:21:15Z","modified":"2026-07-13T14:00:32.648174458Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20232-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\nUpdate to version 3.5.0:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global (bsc#1257329).\n- CVE-2025-12816: interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588).\n\nOther updates and bugfixes:\n\n- Update to 3.5.0 (jsc#PED-13824):\n\n  * [FEATURE] Remote-write: Add support for Azure Workload Identity\n    as an authentication method for the receiver.\n  * [FEATURE] PromQL: Add first_over_time(...) and\n    ts_of_first_over_time(...) behind feature flag.\n  * [FEATURE] Federation: Add support for native histograms with\n    custom buckets (NHCB).\n  * [ENHANCEMENT] PromQL: Add warn-level annotations for counter\n    reset conflicts in certain histogram operations.\n  * [ENHANCEMENT] UI: Add scrape interval and scrape timeout to\n    targets page.\n\n- Update to 3.4.0:\n\n  * Add unified AWS service discovery for ec2, lightsail and ecs services.\n  * [FEATURE] Native histograms are now a stable, but optional\n    feature.\n  * [FEATURE] UI: Show detailed relabeling steps for each\n    discovered target.\n  * [ENHANCEMENT] Alerting: Add \"unknown\" state for alerting rules\n    that haven't been evaluated yet.\n  * [BUGFIX] Scrape: Fix a bug where scrape cache would not be\n    cleared on startup.\n\n- Update to 3.3.0:\n\n  * [FEATURE] Spring Boot 3.3 includes support for the Prometheus\n    Client 1.x.\n  * [ENHANCEMENT] Dependency management for Dropwizard Metrics has\n    been removed.\n\n- Update to 3.2.0:\n\n  * [FEATURE] OAuth2: support jwt-bearer grant-type (RFC7523 3.1).\n  * [ENHANCEMENT] PromQL: Reconcile mismatched NHCB bounds in Add\n    and Sub.\n  * [BUGFIX] TSDB: Native Histogram Custom Bounds with a NaN\n    threshold are now rejected.\n\n- Update to 3.1.0:\n\n  * [FEATURE] Remote-write 2 (receiving): Update to 2.0-rc.4 spec.\n    \"created timestamp\" (CT) is now called \"start timestamp\" (ST).\n  * [BUGFIX] Mixin: Add static UID to the remote-write dashboard.\n\n- Update to 3.0.1:\n\n  * [BUGFIX] Promql: Make subqueries left open.\n  * [BUGFIX] Fix memory leak when query log is enabled.\n  * [BUGFIX] Support utf8 names on /v1/label/:name/values endpoint.\n\n- Update to 3.0.0:\n\n  * [CHANGE] Deprecated feature flags removed.\n  * [FEATURE] New UI.\n  * [FEATURE] Remote Write 2.0.\n  * [FEATURE] OpenTelemetry Support.\n  * [FEATURE] UTF-8 support is now stable and enabled by default.\n  * [FEATURE] OTLP Ingestion.\n  * [FEATURE] Native Histograms.\n  * [BUGFIX] PromQL: Fix count_values for histograms.\n  * [BUGFIX] TSDB: Fix race on stale values in headAppender.\n  * [BUGFIX] UI: Fix selector / series formatting for empty metric\n    names.\n\n- Update to 2.55.0:\n\n  * [FEATURE] PromQL: Add `last_over_time` function.\n  * [FEATURE] Agent: Add `prometheus_agent_build_info` metric.\n  * [ENHANCEMENT] PromQL: Optimise `group()` and `group by()`.\n  * [ENHANCEMENT] TSDB: Reduce memory usage when loading blocks.\n  * [BUGFIX] Scrape: Fix a bug where a target could be scraped\n    multiple times.\n\n- Update to 2.54.0:\n\n  * [CHANGE] Remote-Write: highest_timestamp_in_seconds and\n    queue_highest_sent_timestamp_seconds metrics now initialized to\n    0.\n  * [CHANGE] API: Split warnings from info annotations in API\n    response.\n  * [FEATURE] Remote-Write: Version 2.0 experimental, plus metadata\n    in WAL via feature flag.\n  * [FEATURE] PromQL: add limitk() and limit_ratio() aggregation\n    operators.\n  * [ENHANCEMENT] PromQL: Accept underscores in literal numbers.\n  * [ENHANCEMENT] PromQL: float literal numbers and durations are\n    now interchangeable (experimental).\n  * [ENHANCEMENT] PromQL (experimental native histograms): Optimize\n    histogram_count and histogram_sum functions.\n  * [BUGFIX] PromQL: Fix various issues with native histograms.\n  * [BUGFIX] TSDB: Fix race on stale values in headAppender.\n  * [BUGFIX] OTLP receiver: Allow colons in non-standard units.\n\n","status":"withdrawn","published":"2026-02-05T10:43:17Z","modified":"2026-05-05T08:00:37.779083Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}