{"id":"CVE-2025-47908","aliases":["EUVD-2025-23882","GHSA-mh55-gqvf-xfwm","GO-2024-2883","SUSE-SU-2025:3817-1","SUSE-SU-2025:3819-1","SUSE-SU-2025:4457-1","SUSE-SU-2025:4481-1","UBUNTU-CVE-2025-47908","openSUSE-SU-2025:15424-1","openSUSE-SU-2026:21136-1"],"status":"published","title":"Denial of service via malicious preflight requests in github.com/rs/cors","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00678,"percentile":0.52771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2024-07-02T19:20:36Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Go","package":"github.com/rs/cors","fixed_in":["1.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","fixed_in":["0.28.1-150100.4.28.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"golang-github-prometheus-alertmanager","fixed_in":["0.28.1-150100.4.28.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","fixed_in":["0.28.1-150100.4.28.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"golang-github-prometheus-alertmanager","fixed_in":["0.28.1-150100.4.28.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-alertmanager","fixed_in":["0.28.1-150100.4.28.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rs/cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rs/cors","ranges":[{"type":"SEMVER","events":[{"introduced":"1.9.0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rs/cors","ranges":[{"type":"SEMVER","events":[{"introduced":"1.9.0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"Multi-Linux-ManagerTools-SLE-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12-120002.1.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-120002.4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.7-120002.4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-120002.3.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"python-defusedxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-120002.1.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-120002.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.11-120002.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-120002.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-120002.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150002.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.7-150002.4.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150002.3.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"python-defusedxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-150002.1.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-150002.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.11-150002.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.7-150002.3.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150002.3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.20-150002.3.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150002.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.20-150002.3.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-1.34.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.10-1.87.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-1.30.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.6-21.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.14-38.162.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-6.36.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.37-1.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.28.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.28.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.28.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.28.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.28.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-rs-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-1","1.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-rs-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-2","1.7.0-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-rs-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-rs-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-rs-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-4","1.11.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-rs-cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250807T150727-1.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"github.com/rs/cors","product":"github.com/rs/cors"}],"references":[{"url":"https://github.com/rs/cors/pull/171","tags":["fix","web","report"]},{"url":"https://github.com/rs/cors/issues/170","tags":["report","web"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2883","tags":["web","report"]},{"url":"https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47908","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mh55-gqvf-xfwm"},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47908.json","tags":["advisory"]},{"url":"https://github.com/rs/cors","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253817-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019074","tags":["report"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1229825","tags":["report"]},{"url":"https://bugzilla.suse.com/1243331","tags":["report"]},{"url":"https://bugzilla.suse.com/1243611","tags":["report"]},{"url":"https://bugzilla.suse.com/1243704","tags":["report"]},{"url":"https://bugzilla.suse.com/1244027","tags":["report"]},{"url":"https://bugzilla.suse.com/1244127","tags":["report"]},{"url":"https://bugzilla.suse.com/1245099","tags":["report"]},{"url":"https://bugzilla.suse.com/1245120","tags":["report"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1246068","tags":["report"]},{"url":"https://bugzilla.suse.com/1246320","tags":["report"]},{"url":"https://bugzilla.suse.com/1246553","tags":["report"]},{"url":"https://bugzilla.suse.com/1246586","tags":["report"]},{"url":"https://bugzilla.suse.com/1246628","tags":["report"]},{"url":"https://bugzilla.suse.com/1246735","tags":["report"]},{"url":"https://bugzilla.suse.com/1246736","tags":["report"]},{"url":"https://bugzilla.suse.com/1246789","tags":["report"]},{"url":"https://bugzilla.suse.com/1246864","tags":["report"]},{"url":"https://bugzilla.suse.com/1246882","tags":["report"]},{"url":"https://bugzilla.suse.com/1246906","tags":["report"]},{"url":"https://bugzilla.suse.com/1247688","tags":["report"]},{"url":"https://bugzilla.suse.com/1247748","tags":["report"]},{"url":"https://bugzilla.suse.com/1247836","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6197","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253819-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237495","tags":["report"]},{"url":"https://bugzilla.suse.com/1252100","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254457-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1244534","tags":["report"]},{"url":"https://bugzilla.suse.com/1246662","tags":["report"]},{"url":"https://bugzilla.suse.com/1246738","tags":["report"]},{"url":"https://bugzilla.suse.com/1246925","tags":["report"]},{"url":"https://bugzilla.suse.com/1247721","tags":["report"]},{"url":"https://bugzilla.suse.com/1250616","tags":["report"]},{"url":"https://bugzilla.suse.com/1251044","tags":["report"]},{"url":"https://bugzilla.suse.com/1251138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254481-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-47908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47908","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1002102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47907","tags":["web"]},{"url":"https://bugzilla.suse.com/1236516","tags":["report"]},{"url":"https://bugzilla.suse.com/1238686","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-47908","title":"Denial of service via malicious preflight requests in github.com/rs/cors","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2025-08-06T20:41:31.311Z","modified":"2025-08-07T13:47:15.232Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-23882","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2025-08-06T20:41:31Z","modified":"2025-08-07T13:47:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:00.279926Z"}],"ghsa":[{"id":"GHSA-mh55-gqvf-xfwm","title":"Denial of service via malicious preflight requests in github.com/rs/cors","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2024-07-05T19:42:48Z","modified":"2025-08-06T22:10:53Z","cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:52.85141Z"}],"nvd":[{"id":"CVE-2025-47908","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2025-08-06T21:15:29.313Z","modified":"2026-06-17T09:28:49.67Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:22.319351Z"}],"osv":[{"id":"CVE-2025-47908","title":"Denial of service via malicious preflight requests in github.com/rs/cors","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2025-08-06T20:41:31.311Z","modified":"2026-10-28T02:30:57.203684498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"UBUNTU-CVE-2025-47908","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2025-08-06T21:15:00Z","modified":"2026-10-17T12:56:59.363750587Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"GHSA-mh55-gqvf-xfwm","title":"Denial of service via malicious preflight requests in github.com/rs/cors","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2024-07-05T19:42:48Z","modified":"2026-09-10T03:50:16.858447726Z","cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"GO-2024-2883","title":"Denial of service via malicious preflight requests in github.com/rs/cors","description":"Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.","status":"published","published":"2024-07-02T19:20:36Z","modified":"2026-02-04T04:22:36.439584Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2025:15424-1","title":"govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-08T00:00:00Z","modified":"2026-03-23T04:53:45.821911Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:21136-1","title":"Security update for golang-github-prometheus-alertmanager","description":"This update for golang-github-prometheus-alertmanager fixes the following issues:\n\nChanges in golang-github-prometheus-alertmanager:\n\n- Update to version 0.28.1 (jsc#PED-13285):\n  * Improved performance of inhibition rules when using Equal\n    labels.\n  * Improve the documentation on escaping in UTF-8 matchers.\n  * Update alertmanager_config_hash metric help to document the\n    hash is not cryptographically strong.\n  * Fix panic in amtool when using --verbose.\n  * Fix templating of channel field for Rocket.Chat.\n  * Fix rocketchat_configs written as rocket_configs in docs.\n  * Fix usage for --enable-feature flag.\n  * Trim whitespace from OpsGenie API Key.\n  * Fix Jira project template not rendered when searching for\n    existing issues.\n  * Fix subtle bug in JSON/YAML encoding of inhibition rules that\n    would cause Equal labels to be omitted.\n  * Fix header for slack_configs in docs.\n  * Fix weight and wrap of Microsoft Teams notifications.\n\n- Upgrade to version 0.28.0:\n  * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).\n  * Templating errors in the SNS integration now return an error.\n  * Adopt log/slog, drop go-kit/log.\n  * Add a new Microsoft Teams integration based on Flows.\n  * Add a new Rocket.Chat integration.\n  * Add a new Jira integration.\n  * Add support for GOMEMLIMIT, enable it via the feature flag\n    --enable-feature=auto-gomemlimit.\n  * Add support for GOMAXPROCS, enable it via the feature flag\n    --enable-feature=auto-gomaxprocs.\n  * Add support for limits of silences including the maximum number\n    of active and pending silences, and the maximum size per\n    silence (in bytes). You can use the flags\n    --silences.max-silences and --silences.max-silence-size-bytes\n    to set them accordingly.\n  * Muted alerts now show whether they are suppressed or not in\n    both the /api/v2/alerts endpoint and the Alertmanager UI.\n\n- Upgrade to version 0.27.0:\n  * API: Removal of all api/v1/ endpoints. These endpoints\n    now log and return a deprecation message and respond with a\n    status code of 410.\n  * UTF-8 Support: Introduction of support for any UTF-8\n    character as part of label names and matchers.\n  * Discord Integration: Enforce max length in message.\n  * Metrics: Introduced the experimental feature flag\n    --enable-feature=receiver-name-in-metrics to include the\n    receiver name.\n  * Metrics: Introduced a new gauge named\n    alertmanager_inhibition_rules that counts the number of\n    configured inhibition rules.\n  * Metrics: Introduced a new counter named\n    alertmanager_alerts_supressed_total that tracks muted alerts,\n    it contains a reason label to indicate the source of the mute.\n  * Discord Integration: Introduced support for webhook_url_file.\n  * Microsoft Teams Integration: Introduced support for\n    webhook_url_file.\n  * Microsoft Teams Integration: Add support for summary.\n  * Metrics: Notification metrics now support two new values for\n    the label reason, contextCanceled and contextDeadlineExceeded.\n  * Email Integration: Contents of auth_password_file are now\n    trimmed of prefixed and suffixed whitespace.\n  * amtool: Fixes the error scheme required for webhook url when\n    using amtool with --alertmanager.url.\n  * Mixin: Fix AlertmanagerFailedToSendAlerts,\n    AlertmanagerClusterFailedToSendAlerts, and\n    AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n    the reason label.\n\n- Security:\n  * Fix proxy bypassing using IPv6 zone IDs\n    (CVE-2025-22870, bsc#1238686)\n  * Fix HTTP/2 CONTINUATION flood in net/http\n    (CVE-2023-45288, bsc#1236516)\n  * Add 0002-Bump-x-net.patch\n","status":"published","published":"2026-06-18T08:21:46Z","modified":"2026-06-30T18:24:44.560080982Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2025:3817-1","title":"Security update 5.1.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- Update to version 0.28.1 (jsc#PED-13285):\n  * Improved performance of inhibition rules when using Equal\n    labels.\n  * Improve the documentation on escaping in UTF-8 matchers.\n  * Update alertmanager_config_hash metric help to document the\n    hash is not cryptographically strong.\n  * Fix panic in amtool when using --verbose.\n  * Fix templating of channel field for Rocket.Chat.\n  * Fix rocketchat_configs written as rocket_configs in docs.\n  * Fix usage for --enable-feature flag.\n  * Trim whitespace from OpsGenie API Key.\n  * Fix Jira project template not rendered when searching for\n    existing issues.\n  * Fix subtle bug in JSON/YAML encoding of inhibition rules that\n    would cause Equal labels to be omitted.\n  * Fix header for slack_configs in docs.\n  * Fix weight and wrap of Microsoft Teams notifications.\n- Upgrade to version 0.28.0:\n  * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).\n  * Templating errors in the SNS integration now return an error.\n  * Adopt log/slog, drop go-kit/log.\n  * Add a new Microsoft Teams integration based on Flows.\n  * Add a new Rocket.Chat integration.\n  * Add a new Jira integration.\n  * Add support for GOMEMLIMIT, enable it via the feature flag\n    --enable-feature=auto-gomemlimit.\n  * Add support for GOMAXPROCS, enable it via the feature flag\n    --enable-feature=auto-gomaxprocs.\n  * Add support for limits of silences including the maximum number\n    of active and pending silences, and the maximum size per\n    silence (in bytes). You can use the flags\n    --silences.max-silences and --silences.max-silence-size-bytes\n    to set them accordingly.\n  * Muted alerts now show whether they are suppressed or not in\n    both the /api/v2/alerts endpoint and the Alertmanager UI.\n- Upgrade to version 0.27.0:\n  * API: Removal of all api/v1/ endpoints. These endpoints\n    now log and return a deprecation message and respond with a\n    status code of 410.\n  * UTF-8 Support: Introduction of support for any UTF-8\n    character as part of label names and matchers.\n  * Discord Integration: Enforce max length in message.\n  * Metrics: Introduced the experimental feature flag\n    --enable-feature=receiver-name-in-metrics to include the\n    receiver name.\n  * Metrics: Introduced a new gauge named\n    alertmanager_inhibition_rules that counts the number of\n    configured inhibition rules.\n  * Metrics: Introduced a new counter named\n    alertmanager_alerts_supressed_total that tracks muted alerts,\n    it contains a reason label to indicate the source of the mute.\n  * Discord Integration: Introduced support for webhook_url_file.\n  * Microsoft Teams Integration: Introduced support for\n    webhook_url_file.\n  * Microsoft Teams Integration: Add support for summary.\n  * Metrics: Notification metrics now support two new values for\n    the label reason, contextCanceled and contextDeadlineExceeded.\n  * Email Integration: Contents of auth_password_file are now\n    trimmed of prefixed and suffixed whitespace.\n  * amtool: Fixes the error scheme required for webhook url when\n    using amtool with --alertmanager.url.\n  * Mixin: Fix AlertmanagerFailedToSendAlerts,\n    AlertmanagerClusterFailedToSendAlerts, and\n    AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n    the reason label.\n\ngrafana:\n\n- Update to version 11.5.7:\n  * Security:\n    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards\n                   (bsc#1246735)\n    CVE-2025-6197: Fix open redirect in organization switching\n                   (bsc#1246736)\n  * Bug fixes:\n    Azure: Fix legend formatting.\n    Azure: Fix resource name determination in template variable\n           queries.\n- Update to version 11.5.6:\n    CVE-2025-3415: Fix exposure of DingDing alerting integration\n                   URL to Viewer level users (bsc#1245302)\n\nmgr-push:\n\n- Version 5.1.4-0\n  * Use absolute paths when invoking external commands\n  * Fix syntax error in changelog\n\npython-defusedxml:\n\n- Update to 0.6.0\n  * Increase test coverage.\n  * Add badges to README.\n  * Test on Python 3.7 stable and 3.8-dev\n  * Drop support for Python 3.4\n  * No longer pass *html* argument to XMLParse. It has been deprecated and\n    ignored for a long time. The DefusedXMLParser still takes a html argument.\n    A deprecation warning is issued when the argument is False and a TypeError\n    when it's True.\n  * defusedxml now fails early when pyexpat stdlib module is not available or\n    broken.\n  * defusedxml.ElementTree.__all__ now lists ParseError as public attribute.\n  * The defusedxml.ElementTree and defusedxml.cElementTree modules had a typo\n    and used XMLParse instead of XMLParser as an alias for DefusedXMLParser.\n    Both the old and fixed name are now available.\n- Remove superfluous devel dependency for noarch package\n- Fix source url.\n- Update to 5.0\n  * Add compatibility with Python 3.6\n  * Drop support for Python 2.6, 3.1, 3.2, 3.3\n  * Fix lxml tests (XMLSyntaxError: Detected an entity reference loop)\n- Implement single-spec version.\n- Dummy changelog for bsc#1019074, FATE#322329\n- Initial packaging.\n\nrhnlib:\n\n- Version 5.1.3-0\n  * Fix syntax error in changelog\n  * Use more secure defusedxml parser (bsc#1227577)\n\nspacecmd:\n\n- Version 5.1.11-0\n  * Make spacecmd work with Python 3.12 and higher\n  * Call print statements properly in Python 3\n- Version 5.1.10-0\n  * Fix use of renamed config parser class where the backward\n    compatible alias was dropped in latest python version\n    (bsc#1246586)\n- Version 5.1.9-0\n  * Fix installation of python lib files on Ubuntu 24.04\n\nspacewalk-client-tools:\n\n- Version 5.1.7-0\n  * Fix syntax error in changelog\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.1.4-0\n  * Fix syntax error in changelog\n\nuyuni-tools:\n\n- version 5.1.20-0\n  * Add migration for server monitoring configuration (bsc#1247688)\n\n- version 5.1.19-0\n  * Add a lowercase version of --logLevel (bsc#1243611)\n  * Stop executing scripts in temporary folder (bsc#1243704)\n  * support config: collect podman inspect for hub container\n    (bsc#1245099)\n  * Use new dedicated path for Cobbler settings (bsc#1244027)\n  * Migrate custom auto installation snippets (bsc#1246320)\n  * Add SUSE Linux Enterprise 15 SP7 to buildin productmap\n  * Fix loading product map from mgradm configuration file\n    (bsc#1246068)\n  * Fix channel override for distro copy\n  * Do not use sudo when running as a root user (bsc#1246882)\n  * Do not require backups to be at the same location for restoring\n    (bsc#1246906)\n  * Fix recomputing proxy images when installing a PTF or TEST\n    (bsc#1246553)\n  * Add mgradm server rename to change the server FQDN (bsc#1229825)\n  * If no DB SSL CA parameter is given, use the other one\n    (bsc#1245120)\n  * More fault tolerant mgradm stop (bsc#1243331)\n  * Backup systemd dropin directory too and create if missing\n  * Add 3rd party SSL options for upgrade and migration scenarios\n  * Do not consider stderr output of podman as an error\n    (bsc#1247836)\n  * Restore SELinux contexts for restored backup volumes\n    (bsc#1244127)\n  * Automatically get up-to-date systemid file on salt based proxy\n    hosts (bsc#1246789)\n  * Bump the default image tag to 5.1.1\n\n- version 5.1.18-0\n  * Update translation strings\n\n- version 5.1.17-0\n  * upgrade saline should use scale function (bsc#1246864)\n\n- version 5.1.16-0\n  * Use database backup volume as temporary backup location\n    (bsc#1246628)\n\n","status":"published","published":"2025-10-28T07:19:09Z","modified":"2026-02-04T02:32:56.154893Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3819-1","title":"Security update 5.1.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot was updated from version 0.1 to version 1.0.0:\n\n- Version 1.0.0 bugs fixed:\n    \n  * Reboot on salt key timeout (bsc#1237495)\n  * Fixed parsing files with space in the name (bsc#1252100)\n\ngolang-github-prometheus-alertmanager was updated from version 0.26.0 to 0.28.1 to :\n\n- Security issues fixed:\n\n  * CVE-2025-47908: Fixed a Denial of Service vulnerability (bsc#1247748)\n\n- Version 0.28.1 changes and bugs fixed (jsc#PED-13285):\n\n  * Improved performance of inhibition rules when using Equal\n    labels.\n  * Improve the documentation on escaping in UTF-8 matchers.\n  * Update alertmanager_config_hash metric help to document the\n    hash is not cryptographically strong.\n  * Fixed panic in amtool when using --verbose.\n  * Fixed templating of channel field for Rocket.Chat.\n  * Fixed rocketchat_configs written as rocket_configs in docs.\n  * Fixed usage for --enable-feature flag.\n  * Trim whitespace from OpsGenie API Key.\n  * Fixed Jira project template not rendered when searching for\n    existing issues.\n  * Fixed subtle bug in JSON/YAML encoding of inhibition rules that\n    would cause Equal labels to be omitted.\n  * Fixed header for slack_configs in docs.\n  * Fixed weight and wrap of Microsoft Teams notifications.\n  \n- Version 0.28.0 changes and bugs fixed:\n\n  * Templating errors in the SNS integration now return an error.\n  * Adopt log/slog, drop go-kit/log.\n  * Added a new Microsoft Teams integration based on Flows.\n  * Added a new Rocket.Chat integration.\n  * Added a new Jira integration.\n  * Added support for GOMEMLIMIT, enable it via the feature flag\n    --enable-feature=auto-gomemlimit.\n  * Added support for GOMAXPROCS, enable it via the feature flag\n    --enable-feature=auto-gomaxprocs.\n  * Added support for limits of silences including the maximum number\n    of active and pending silences, and the maximum size per\n    silence (in bytes). You can use the flags\n    --silences.max-silences and --silences.max-silence-size-bytes\n    to set them accordingly.\n  * Muted alerts now show whether they are suppressed or not in\n    both the /api/v2/alerts endpoint and the Alertmanager UI.\n\n- Version 0.27.0 changes and bugs fixed:\n\n  * API: Removal of all api/v1/ endpoints. These endpoints\n    now log and return a deprecation message and respond with a\n    status code of 410.\n  * UTF-8 Support: Introduction of support for any UTF-8\n    character as part of label names and matchers.\n  * Discord Integration: Enforce max length in message.\n  * Metrics: Introduced the experimental feature flag\n    --enable-feature=receiver-name-in-metrics to include the\n    receiver name.\n  * Metrics: Introduced a new gauge named\n    alertmanager_inhibition_rules that counts the number of\n    configured inhibition rules.\n  * Metrics: Introduced a new counter named\n    alertmanager_alerts_supressed_total that tracks muted alerts,\n    it contains a reason label to indicate the source of the mute.\n  * Discord Integration: Introduced support for webhook_url_file.\n  * Microsoft Teams Integration: Introduced support for\n    webhook_url_file.\n  * Microsoft Teams Integration: Added support for summary.\n  * Metrics: Notification metrics now support two new values for\n    the label reason, contextCanceled and contextDeadlineExceeded.\n  * Email Integration: Contents of auth_password_file are now\n    trimmed of prefixed and suffixed whitespace.\n  * amtool: Fixes the error scheme required for webhook url when\n    using amtool with --alertmanager.url.\n  * Mixin: Fixed AlertmanagerFailedToSendAlerts,\n    AlertmanagerClusterFailedToSendAlerts, and\n    AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n    the reason label.\n\ngrafana was updated to from version 11.5.5 to 11.5.7:\n    \n- Security issues fixed:\n\n  * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (bsc#1246735)\n  * CVE-2025-6197: Fixed open redirect in organization switching (bsc#1246736)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n\n- Other bugs fixed:\n\n  * Azure: Fixed legend formatting.\n  * Azure: Fixed resource name determination in template variable queries.\n\nmgr-push was updated from version 5.1.3 to 5.1.4:\n\n- Use absolute paths when invoking external commands\n\npython-defusedxml:\n\n- New package implemented at version 0.7.1\n\nrhnlib was updated from version 5.1.2 to 5.1.3:\n\n- Use more secure defusedxml parser (bsc#1227577)\n\nspacecmd was updated from version 5.1.8 to 5.1.11:\n\n- Version 5.1.11 changes and bugs fixed:\n\n  * Make spacecmd work with Python 3.12 and higher\n  * Call print statements properly in Python 3\n\n- Version 5.1.10 changes and bugs fixed:\n\n  * Fixed use of renamed config parser class where the backward\n    compatible alias was dropped in latest python version\n    (bsc#1246586)\n\n- Version 5.1.9 changes and bugs fixed:\n\n  * Fixed installation of python lib files on Ubuntu 24.04\n\nspacewalk-client-tools was updated from version 5.1.6 to 5.1.7:\n\n-  Fixed syntax error in changelog\n\nsupportutils-plugin-susemanager-client was updated from version 5.1.3 to 5.1.4:\n\n-  Fixed syntax error in changelog\n\nuyuni-tools was updated from version 5.1.15 to 5.1.20:\n\n- Version 5.1.20 changes and bugs fixed:\n\n  * Added migration for server monitoring configuration (bsc#1247688)\n\n- Version 5.1.19 changes and bugs fixed:\n\n  * Added a lowercase version of --logLevel (bsc#1243611)\n  * Stop executing scripts in temporary folder (bsc#1243704)\n  * support config: collect podman inspect for hub container (bsc#1245099)\n  * Use new dedicated path for Cobbler settings (bsc#1244027)\n  * Migrate custom auto installation snippets (bsc#1246320)\n  * Added SUSE Linux Enterprise 15 SP7 to buildin productmap\n  * Fixed loading product map from mgradm configuration file (bsc#1246068)\n  * Fixed channel override for distro copy\n  * Do not use sudo when running as a root user (bsc#1246882)\n  * Do not require backups to be at the same location for restoring (bsc#1246906)\n  * Fixed recomputing proxy images when installing a PTF or TEST (bsc#1246553)\n  * Added mgradm server rename to change the server FQDN (bsc#1229825)\n  * If no DB SSL CA parameter is given, use the other one (bsc#1245120)\n  * More fault tolerant mgradm stop (bsc#1243331)\n  * Backup systemd dropin directory too and create if missing\n  * Added 3rd party SSL options for upgrade and migration scenarios\n  * Do not consider stderr output of podman as an error (bsc#1247836)\n  * Restore SELinux contexts for restored backup volumes (bsc#1244127)\n  * Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)\n  * Bump the default image tag to 5.1.1\n\n- Version 5.1.18 changes and bugs fixed:\n\n  * Updated translation strings\n  \n- Version 5.1.17 changes and bugs fixed:\n\n  * Upgrade of saline should use scale function (bsc#1246864)\n\n- Version 5.1.16 changes and bugs fixed:\n\n  * Use database backup volume as temporary backup location (bsc#1246628)\n\n","status":"published","published":"2025-10-28T07:20:07Z","modified":"2026-02-04T04:35:22.439371Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4457-1","title":"Security update 5.0.6 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- Update to version 0.28.1 (jsc#PED-13285):\n  * Improved performance of inhibition rules when using Equal\n    labels.\n  * Improve the documentation on escaping in UTF-8 matchers.\n  * Update alertmanager_config_hash metric help to document the\n    hash is not cryptographically strong.\n  * Fix panic in amtool when using --verbose.\n  * Fix templating of channel field for Rocket.Chat.\n  * Fix rocketchat_configs written as rocket_configs in docs.\n  * Fix usage for --enable-feature flag.\n  * Trim whitespace from OpsGenie API Key.\n  * Fix Jira project template not rendered when searching for\n    existing issues.\n  * Fix subtle bug in JSON/YAML encoding of inhibition rules that\n    would cause Equal labels to be omitted.\n  * Fix header for slack_configs in docs.\n  * Fix weight and wrap of Microsoft Teams notifications.\n- Upgrade to version 0.28.0:\n  * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).\n  * Templating errors in the SNS integration now return an error.\n  * Adopt log/slog, drop go-kit/log.\n  * Add a new Microsoft Teams integration based on Flows.\n  * Add a new Rocket.Chat integration.\n  * Add a new Jira integration.\n  * Add support for GOMEMLIMIT, enable it via the feature flag\n    --enable-feature=auto-gomemlimit.\n  * Add support for GOMAXPROCS, enable it via the feature flag\n    --enable-feature=auto-gomaxprocs.\n  * Add support for limits of silences including the maximum number\n    of active and pending silences, and the maximum size per\n    silence (in bytes). You can use the flags\n    --silences.max-silences and --silences.max-silence-size-bytes\n    to set them accordingly.\n  * Muted alerts now show whether they are suppressed or not in\n    both the /api/v2/alerts endpoint and the Alertmanager UI.\n- Upgrade to version 0.27.0:\n  * API: Removal of all api/v1/ endpoints. These endpoints\n    now log and return a deprecation message and respond with a\n    status code of 410.\n  * UTF-8 Support: Introduction of support for any UTF-8\n    character as part of label names and matchers.\n  * Discord Integration: Enforce max length in message.\n  * Metrics: Introduced the experimental feature flag\n    --enable-feature=receiver-name-in-metrics to include the\n    receiver name.\n  * Metrics: Introduced a new gauge named\n    alertmanager_inhibition_rules that counts the number of\n    configured inhibition rules.\n  * Metrics: Introduced a new counter named\n    alertmanager_alerts_supressed_total that tracks muted alerts,\n    it contains a reason label to indicate the source of the mute.\n  * Discord Integration: Introduced support for webhook_url_file.\n  * Microsoft Teams Integration: Introduced support for\n    webhook_url_file.\n  * Microsoft Teams Integration: Add support for summary.\n  * Metrics: Notification metrics now support two new values for\n    the label reason, contextCanceled and contextDeadlineExceeded.\n  * Email Integration: Contents of auth_password_file are now\n    trimmed of prefixed and suffixed whitespace.\n  * amtool: Fixes the error scheme required for webhook url when\n    using amtool with --alertmanager.url.\n  * Mixin: Fix AlertmanagerFailedToSendAlerts,\n    AlertmanagerClusterFailedToSendAlerts, and\n    AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n    the reason label.\n\ngrafana was updated from version 11.5.5 to 11.5.10:\n\n- Security issues fixed:\n  \n  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)\n  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)\n  * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client\n                    (bsc#1254113)\n  * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)\n  * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)\n  * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)\n                   (bsc#1245302)\n\n- Other changes, new features and bugs fixed:\n\n  * Version 11.5.10:\n    + Update to Go 1.25\n    + Update to golang.org/x/net v0.45.0\n    + Auth: Fix render user OAuth passthrough\n    + LDAP Authentication: Fix URL to propagate username context as parameter\n    \n  * Version 11.5.9:\n    + Auditing: Document new options for recording datasource query request/response body.\n    + Login: Fixed redirection after login when Grafana is served from subpath.\n\n  * Version 11.5.7:\n    + Azure: Fixed legend formatting and resource name determination in template variable queries.\n\nmgr-push:\n\n- Version 5.0.3-0\n  * Fixed syntax error in changelog\n\nrhnlib:\n\n- Version 5.0.6-0\n  * Use more secure defusedxml parser (bsc#1227577)\n\nspacecmd:\n\n- Version 5.0.14-0:\n\n  * Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)\n  * Use JSON instead of pickle for spacecmd cache (bsc#1227579)\n  * Make spacecmd to work with Python 3.12 and higher\n  * Call print statements properly in Python 3\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.0.5-0\n  * Fix syntax error in changelog\n\nuyuni-tools:\n\n- Version 0.1.37-0\n  * Handle CA files with symlinks during migration (bsc#1251044)\n  * Add a lowercase version of --logLevel (bsc#1243611)\n  * Adjust traefik exposed configuration for chart v27+ (bsc#1247721)\n  * Stop executing scripts in temporary folder (bsc#1243704)\n  * Convert the traefik install time to local time (bsc#1251138)\n  * Run smdba and reindex only during migration (bsc#1244534)\n  * Support config: collect podman inspect for hub container (bsc#1245099)\n  * Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry\n  * Deprecate --registry\n  * Use new dedicated path for Cobbler settings (bsc#1244027)\n  * Migrate custom auto installation snippets (bsc#1246320)\n  * Add SLE15SP7 to buildin productmap\n  * Fix loading product map from mgradm configuration file (bsc#1246068)\n  * Fix channel override for distro copy\n  * Do not use sudo when running as a root user (bsc#1246882)\n  * Do not require backups to be at the same location for restoring (bsc#1246906)\n  * Check for restorecon presence before calling (bsc#1246925)\n  * Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)\n  * Fix recomputing proxy images when installing a ptf or test (bsc#1246553)\n  * Add migration for server monitoring configuration (bsc#1247688)\n- Version 0.1.36-0\n  * Bump the default image tag\n- Version 0.1.35-0\n  * Restore SELinux contexts for restored backup volumes (bsc#1244127)\n- Version 0.1.34-0\n  * Fix mgradm backup create handling of images and systemd files (bsc#1246738)\n- Version 0.1.33-0\n  * Restore volumes using tar instead of podman import (bsc#1244127)\n\n","status":"published","published":"2025-12-18T11:56:34Z","modified":"2026-03-23T04:51:41.244571Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2025:4481-1","title":"Security update for golang-github-prometheus-alertmanager","description":"This update for golang-github-prometheus-alertmanager fixes the following issues:\n\n- Update to version 0.28.1 (jsc#PED-13285):\n  * Improved performance of inhibition rules when using Equal\n    labels.\n  * Improve the documentation on escaping in UTF-8 matchers.\n  * Update alertmanager_config_hash metric help to document the\n    hash is not cryptographically strong.\n  * Fix panic in amtool when using --verbose.\n  * Fix templating of channel field for Rocket.Chat.\n  * Fix rocketchat_configs written as rocket_configs in docs.\n  * Fix usage for --enable-feature flag.\n  * Trim whitespace from OpsGenie API Key.\n  * Fix Jira project template not rendered when searching for\n    existing issues.\n  * Fix subtle bug in JSON/YAML encoding of inhibition rules that\n    would cause Equal labels to be omitted.\n  * Fix header for slack_configs in docs.\n  * Fix weight and wrap of Microsoft Teams notifications.\n- Upgrade to version 0.28.0:\n  * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).\n  * Templating errors in the SNS integration now return an error.\n  * Adopt log/slog, drop go-kit/log.\n  * Add a new Microsoft Teams integration based on Flows.\n  * Add a new Rocket.Chat integration.\n  * Add a new Jira integration.\n  * Add support for GOMEMLIMIT, enable it via the feature flag\n    --enable-feature=auto-gomemlimit.\n  * Add support for GOMAXPROCS, enable it via the feature flag\n    --enable-feature=auto-gomaxprocs.\n  * Add support for limits of silences including the maximum number\n    of active and pending silences, and the maximum size per\n    silence (in bytes). You can use the flags\n    --silences.max-silences and --silences.max-silence-size-bytes\n    to set them accordingly.\n  * Muted alerts now show whether they are suppressed or not in\n    both the /api/v2/alerts endpoint and the Alertmanager UI.\n- Upgrade to version 0.27.0:\n  * API: Removal of all api/v1/ endpoints. These endpoints\n    now log and return a deprecation message and respond with a\n    status code of 410.\n  * UTF-8 Support: Introduction of support for any UTF-8\n    character as part of label names and matchers.\n  * Discord Integration: Enforce max length in message.\n  * Metrics: Introduced the experimental feature flag\n    --enable-feature=receiver-name-in-metrics to include the\n    receiver name.\n  * Metrics: Introduced a new gauge named\n    alertmanager_inhibition_rules that counts the number of\n    configured inhibition rules.\n  * Metrics: Introduced a new counter named\n    alertmanager_alerts_supressed_total that tracks muted alerts,\n    it contains a reason label to indicate the source of the mute.\n  * Discord Integration: Introduced support for webhook_url_file.\n  * Microsoft Teams Integration: Introduced support for\n    webhook_url_file.\n  * Microsoft Teams Integration: Add support for summary.\n  * Metrics: Notification metrics now support two new values for\n    the label reason, contextCanceled and contextDeadlineExceeded.\n  * Email Integration: Contents of auth_password_file are now\n    trimmed of prefixed and suffixed whitespace.\n  * amtool: Fixes the error scheme required for webhook url when\n    using amtool with --alertmanager.url.\n  * Mixin: Fix AlertmanagerFailedToSendAlerts,\n    AlertmanagerClusterFailedToSendAlerts, and\n    AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n    the reason label.\n","status":"published","published":"2025-12-18T12:18:50Z","modified":"2026-03-23T04:49:23.30374Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}