{"id":"CVE-2025-61686","aliases":["CLSA-2026-1775521863","CLSA-2026-1784856210","CLSA-2026-1790461041","CLSA-2026-1792161539","CLSA-2026-1792161542","CLSA-2026-1792253395","CLSA-2026-1792279963","CLSA-2026-1792279967","CLSA-2026-1792419111","CLSA-2026-1792419188","CLSA-2026-1792419267","CLSA-2026-1792419623","CLSA-2026-1792421941","CLSA-2026-1792424730","CLSA-2026-1792425405","CLSA-2026-1792428107","CLSA-2026-1792430030","EUVD-2026-1468","GHSA-9583-h5hc-x8cw","SUSE-SU-2026:4585-1","SUSE-SU-2026:4606-1"],"status":"published","title":"React Router has Path Traversal in File Session Storage","description":"React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.17346,"percentile":0.97133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2026-01-08T20:45:07Z","modified":"2026-11-02T19:59:08Z","exploits":[{"source":"pocgithub","id":"FlowerWitch/CVE-2025-61686_docker","title":"FlowerWitch/CVE-2025-61686_docker","date":"2026-01-15","url":"https://github.com/FlowerWitch/CVE-2025-61686_docker"},{"source":"pocgithub","id":"Kai-One001/React-Router-CVE-2025-61686-","title":"Kai-One001/React-Router-CVE-2025-61686-","date":"2026-01-16","url":"https://github.com/Kai-One001/React-Router-CVE-2025-61686-"},{"source":"pocgithub","id":"boroeurnprach/CVE-2025-61686-PoC","title":"boroeurnprach/CVE-2025-61686-PoC","date":"2026-01-21","url":"https://github.com/boroeurnprach/CVE-2025-61686-PoC"}],"fixes":[{"ecosystem":"npm","package":"@react-router/node","fixed_in":["7.9.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@remix-run/node","fixed_in":["2.17.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@remix-run/deno","fixed_in":["2.17.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@remix-run/deno","fixed_in":["2.17.0-tuxcare.1","1.19.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@remix-run/node","fixed_in":["2.17.0-tuxcare.1","1.19.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-router-dom","fixed_in":["7.5.1-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/node","fixed_in":["7.5.1-tuxcare.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.9.3"},{"fixed":"7.9.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@remix-run/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.17.1"},{"fixed":"2.17.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@remix-run/deno","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.17.1"},{"fixed":"2.17.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/deno","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0-tuxcare.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0-tuxcare.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/deno","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.3-tuxcare.0"},{"fixed":"1.19.3-tuxcare.4"}]}],"versions":["1.19.3","1.19.3-tuxcare.1","1.19.3-tuxcare.2","1.19.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.3-tuxcare.0"},{"fixed":"1.19.3-tuxcare.4"}]}],"versions":["1.19.3","1.19.3-tuxcare.1","1.19.3-tuxcare.2","1.19.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/server-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0-tuxcare.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/server-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.3-tuxcare.0"},{"fixed":"1.19.3-tuxcare.4"}]}],"versions":["1.19.3","1.19.3-tuxcare.1","1.19.3-tuxcare.2","1.19.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0-tuxcare.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.3-tuxcare.0"},{"fixed":"1.19.3-tuxcare.4"}]}],"versions":["1.19.3","1.19.3-tuxcare.1","1.19.3-tuxcare.2","1.19.3-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/serve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.5"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"@react-router/node","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.9.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@remix-run/node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.17.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@remix-run/deno","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150100.4.40.2"}]}],"bundled":11}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"gatekeeper 3"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"migration toolkit for applications 7"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"migration toolkit for containers"},{"vendor":"red hat","product":"migration toolkit for virtualization"},{"vendor":"red hat","product":"multicluster engine for kubernetes"},{"vendor":"red hat","product":"network observability operator"},{"vendor":"red hat","product":"node healthcheck operator"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 2"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat advanced cluster security 4"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of kueue"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat connectivity link 1"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat edge manager 1"},{"vendor":"red hat","product":"red hat edge manager preview"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"red hat trusted artifact signer"},{"vendor":"red hat","product":"red hat trusted profile analyzer"},{"vendor":"remix-run","product":"react-router"},{"vendor":"shopify","product":"react-router\\/node"},{"vendor":"shopify","product":"remix-run\\/deno"},{"vendor":"shopify","product":"remix-run\\/node"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-9583-h5hc-x8cw","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61686","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428423","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61686.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61686","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9583-h5hc-x8cw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61686.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264606-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61686","title":"React Router has Path Traversal in File Session Storage","description":"React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.","status":"published","published":"2026-01-10T02:41:22.741Z","modified":"2026-07-15T01:25:34.058Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-22","CWE-22"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2026-1468","description":"React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.","status":"published","published":"2026-01-10T02:41:22Z","modified":"2026-07-15T01:25:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:54.255702Z"}],"ghsa":[{"id":"GHSA-9583-h5hc-x8cw","title":"React Router has Path Traversal in File Session Storage","description":"If applications use `createFileSessionStorage()` from `@react-router/node` (or `@remix-run/node`/`@remix-run/deno` in Remix v2) with an [**unsigned cookie**](https://reactrouter.com/explanation/sessions-and-cookies#signing-cookies), it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. \n\nRead files cannot be returned directly to the attacker.  Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.","status":"published","published":"2026-01-08T20:45:07Z","modified":"2026-09-18T21:03:29Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2025-61686","description":"React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.","status":"published","published":"2026-01-10T03:15:48.283Z","modified":"2026-07-15T02:17:32.15Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-61686","title":"React Router has Path Traversal in File Session Storage","description":"React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.","status":"published","published":"2026-01-10T02:41:22.741Z","modified":"2026-10-28T02:31:11.170940768Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"GHSA-9583-h5hc-x8cw","title":"React Router has Path Traversal in File Session Storage","description":"If applications use `createFileSessionStorage()` from `@react-router/node` (or `@remix-run/node`/`@remix-run/deno` in Remix v2) with an [**unsigned cookie**](https://reactrouter.com/explanation/sessions-and-cookies#signing-cookies), it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. \n\nRead files cannot be returned directly to the attacker.  Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.","status":"published","published":"2026-01-08T20:45:07Z","modified":"2026-09-18T21:15:04.608726085Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"CLSA-2026-1775521863","title":"TuxCare security update for @remix-run (1 CVE)","description":"TuxCare rebuilt 2 @remix-run packages to address 1 CVE. Fixed in 2.17.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-11-02T19:58:32.656174515Z","updated_at":"2026-11-02T20:23:44.164659Z"},{"id":"CLSA-2026-1784856210","title":"TuxCare security update for 2 packages (3 CVEs)","description":"TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-19T19:15:15.413140949Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790461041","title":"TuxCare security update for @remix-run (1 CVE)","description":"TuxCare rebuilt 2 @remix-run packages to address 1 CVE. Fixed in 1.19.3-tuxcare.4.","status":"published","published":"2026-09-26T22:17:21Z","modified":"2026-11-02T19:58:30.707081995Z","updated_at":"2026-11-02T20:23:44.164659Z"},{"id":"CLSA-2026-1792161539","title":"TuxCare security update for @remix-run/server-runtime (4 CVEs)","description":"TuxCare rebuilt @remix-run/server-runtime to address 4 CVEs. Fixed in 2.17.0-tuxcare.1.","status":"published","published":"2026-10-16T14:38:59Z","modified":"2026-10-16T16:31:05.417294023Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161542","title":"TuxCare security update for @remix-run/server-runtime (3 CVEs)","description":"TuxCare rebuilt @remix-run/server-runtime to address 3 CVEs. Fixed in 1.19.3-tuxcare.4.","status":"published","published":"2026-10-16T14:39:02Z","modified":"2026-10-16T16:30:31.970210428Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792253395","title":"TuxCare security update for react-router-dom (1 CVE)","description":"TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-17T16:09:55Z","modified":"2026-11-02T19:59:08.186375602Z","updated_at":"2026-11-02T20:20:54.36149Z"},{"id":"CLSA-2026-1792279963","title":"TuxCare security update for @remix-run/react (3 CVEs)","description":"TuxCare rebuilt @remix-run/react to address 3 CVEs. Fixed in 2.17.0-tuxcare.1.","status":"published","published":"2026-10-17T23:32:43Z","modified":"2026-11-02T19:58:35.749018705Z","updated_at":"2026-11-02T20:23:21.540308Z"},{"id":"CLSA-2026-1792279967","title":"TuxCare security update for @remix-run/react (2 CVEs)","description":"TuxCare rebuilt @remix-run/react to address 2 CVEs. Fixed in 1.19.3-tuxcare.4.","status":"published","published":"2026-10-17T23:32:46Z","modified":"2026-11-02T19:58:28.972508411Z","updated_at":"2026-11-02T20:23:55.577236Z"},{"id":"CLSA-2026-1792419111","title":"TuxCare security update for @react-router/architect (3 CVEs)","description":"TuxCare rebuilt @react-router/architect to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T14:11:50Z","modified":"2026-10-19T19:15:13.329388906Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419188","title":"TuxCare security update for @react-router/cloudflare (3 CVEs)","description":"TuxCare rebuilt @react-router/cloudflare to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T14:13:07Z","modified":"2026-10-19T19:15:10.627188864Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419267","title":"TuxCare security update for @react-router/express (3 CVEs)","description":"TuxCare rebuilt @react-router/express to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T14:14:27Z","modified":"2026-10-19T19:15:11.93217351Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419623","title":"TuxCare security update for @react-router/node (1 CVE)","description":"TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T14:20:23Z","modified":"2026-11-02T19:58:34.493972517Z","updated_at":"2026-11-02T20:23:27.713928Z"},{"id":"CLSA-2026-1792421941","title":"TuxCare security update for @react-router/remix-routes-option-adapter (3 CVEs)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T14:59:00Z","modified":"2026-10-19T19:15:11.635471736Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792424730","title":"TuxCare security update for @react-router/dev (3 CVEs)","description":"TuxCare rebuilt @react-router/dev to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T15:45:29Z","modified":"2026-10-19T19:15:02.916300028Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792425405","title":"TuxCare security update for @react-router/fs-routes (3 CVEs)","description":"TuxCare rebuilt @react-router/fs-routes to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T15:56:44Z","modified":"2026-10-19T19:15:12.328827247Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428107","title":"TuxCare security update for @react-router/serve (3 CVEs)","description":"TuxCare rebuilt @react-router/serve to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T16:41:46Z","modified":"2026-10-19T19:15:22.077729358Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792430030","title":"TuxCare security update for create-react-router (3 CVEs)","description":"TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.5.","status":"published","published":"2026-10-19T17:13:49Z","modified":"2026-10-19T19:15:22.934222328Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n\ngrafana was updated to version 12.4.10:\n\n- Security issues:\n\n  * CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)\n  * CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)\n  * CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973)\n  * CVE-2026-19475: Fixed DoS risks in PostgreSQL Datasource by checking timeGroup macros (bsc#1278307)\n  * CVE-2026-14199: Fixed auth bypass or session takeover via Auth Proxy cache key collision (bsc#1278322)\n  * CVE-2026-19197: Fixed access control and authorization checks in dashboard snapshots (bsc#1277025)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm (bsc#1272008)\n  * CVE-2026-41178: Fixed denial-of-service risks in OpenTelemetry baggage parsing (bsc#1276658)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274217)\n  * CVE-2026-8595: Fixed stored XSS via malicious dashboard field names in table panels (bsc#1271557)\n  * CVE-2026-42127: Fixed DoS risks in the public dashboard query endpoint (bsc#1268868)\n  * CVE-2026-9029: Fixed arbitrary code execution and script injection in the geomap panel (bsc#1272328)\n  * CVE-2026-33814: Fixed infinite loop in HTTP/2 transport during framesize check (bsc#1265763)\n  * CVE-2026-8609: Fixed pre-authentication denial-of-service risks in OAuth login routes (bsc#1271330)\n  * CVE-2026-1229: Fixed incorrect value calculation in ecc/p384 Package (bsc#1265525, bsc#1262187)\n  * CVE-2025-12141: Fixed information disclosure of secure settings via contact point modification (bsc#1262187)\n  * CVE-2026-21723: Fixed out-of-memory and denial-of-service risks in templates test endpoint (bsc#1272427)\n  * CVE-2026-41606: Fixed denial-of-service risks from nested messages in Apache Thrift parser (bsc#1263330)\n\n- Bug fixes and changes:\n\n  * Dashboards: Fix adhoc and groupby variable datasource on UI import\n  * Dashboards: Fix version dates and user display names in the legacy version history page\n  * Dashboard Import: Labels in v2 schema\n  * Azure Monitor: fix migration for dimension filters\n  * Dashboards: Get annotations and dashboard endpoint performance improvements\n  * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n  * Alerting: Add protected fields authorization check to provisioning API\n  * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n  * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n  * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7:\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:24:34Z","modified":"2026-10-08T19:15:05.011279037Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4606-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n  \n  ","status":"published","published":"2026-10-09T12:30:05Z","modified":"2026-10-10T09:30:06.444759656Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}