{"id":"CVE-2026-37236","aliases":["AZL-98253","AZL-98256","AZL-98343","AZL-98346","AZL-98349","AZL-98352","AZL-98355","AZL-98358","AZL-98361","AZL-98364","AZL-98367","AZL-98373","AZL-98376","AZL-98379","AZL-98385","AZL-98388","AZL-98391","AZL-98394","AZL-98436","DEBIAN-CVE-2026-37236","EUVD-2026-67776","GHSA-6gx8-r37x-4vw8","SUSE-SU-2026:23456-1","SUSE-SU-2026:23506-1","SUSE-SU-2026:23522-1","SUSE-SU-2026:23688-1","SUSE-SU-2026:23852-1","SUSE-SU-2026:23864-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:4045-1","SUSE-SU-2026:4175-1","SUSE-SU-2026:4408-1","UBUNTU-CVE-2026-37236","openSUSE-SU-2026:11667-1","openSUSE-SU-2026:11669-1","openSUSE-SU-2026:11676-1","openSUSE-SU-2026:11697-1","openSUSE-SU-2026:11718-1","openSUSE-SU-2026:11803-1","openSUSE-SU-2026:11828-1","openSUSE-SU-2026:21793-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21809-1","openSUSE-SU-2026:21898-1","openSUSE-SU-2026:22032-1"],"status":"published","title":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X...","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00434,"percentile":0.37974,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2026-08-28T00:00:00Z","modified":"2026-11-06T14:17:26Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cf-cli","fixed_in":["8.7.11-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cloud-provider-kubevirt","fixed_in":["0.5.1-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerd2","fixed_in":["2.3.4-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cri-tools","fixed_in":["1.32.0-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-buildx","fixed_in":["0.14.0-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"etcd","fixed_in":["3.5.35-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"flannel","fixed_in":["0.24.2-32"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"keda","fixed_in":["2.14.1-19"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","fixed_in":["0.0.10-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.10-30"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-containerd-cc","fixed_in":["1.7.7-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.18-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"prometheus-adapter","fixed_in":["0.12.0-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-33"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-grpc-ecosystem-grpc-gateway","fixed_in":["2.30.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm3","fixed_in":["3.21.3-7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"azl-otel-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.127.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cf-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.11-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cloud-provider-kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.0-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.35-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"flannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.2-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kube-vip-cloud-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.10-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"opa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.63.0-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"prometheus-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-33"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-1","1.16.0-2","1.16.0-3","1.16.0-4","1.6.4-2","2.20.0-1","2.20.0-2","2.27.2-1","2.27.2-2","2.27.2-3","2.30.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.0-2","2.27.2-1","2.27.2-2","2.27.2-3","2.30.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-1"}]}],"versions":["2.20.0-2","2.27.2-1","2.27.2-2","2.27.2-3"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-slfo.1.1_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+git20170127.54.6863684-1","1.2.2-1","1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-3build1","1.16.0-4","1.16.0-4ubuntu0.24.04.1","1.16.0-4ubuntu0.24.04.2","1.16.0-4ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.0-2build1","2.27.2-1","2.27.2-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-grpc-ecosystem-grpc-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.0-2","2.20.0-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300072.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19}],"references":[{"url":"https://github.com/grpc-ecosystem/grpc-gateway/commit/72123cd4f32545f6e1376873f412dcdcbcf29acc","tags":["fix","report"]},{"url":"https://github.com/grpc-ecosystem/grpc-gateway","tags":["package","report"]},{"url":"https://s00me00ne.com/cve/cve-2026-37236/","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37236","tags":["web","advisory"]},{"url":"https://s00me00ne.com/cve/cve-2026-37236"},{"url":"https://github.com/advisories/GHSA-6gx8-r37x-4vw8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37236.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-37236","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623456-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1272402","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1277949","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63308","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623506-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276644","tags":["report"]},{"url":"https://bugzilla.suse.com/1278270","tags":["report"]},{"url":"https://bugzilla.suse.com/1278273","tags":["report"]},{"url":"https://bugzilla.suse.com/1278688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623522-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623688-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623852-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268884","tags":["report"]},{"url":"https://bugzilla.suse.com/1276677","tags":["report"]},{"url":"https://bugzilla.suse.com/1277966","tags":["report"]},{"url":"https://bugzilla.suse.com/1278997","tags":["report"]},{"url":"https://bugzilla.suse.com/1279219","tags":["report"]},{"url":"https://bugzilla.suse.com/1279316","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623864-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264045-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276739","tags":["report"]},{"url":"https://bugzilla.suse.com/1277995","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264175-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-37236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-37236","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75890","tags":["web"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1276124","tags":["report"]},{"url":"https://bugzilla.suse.com/1276651","tags":["report"]},{"url":"https://bugzilla.suse.com/1277965","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72817","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-37236","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T18:14:42.882Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-67776","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-09-02T18:14:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-6gx8-r37x-4vw8","title":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X...","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T18:31:28Z","modified":"2026-09-02T21:31:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:11:17.943368Z"}],"nvd":[{"id":"CVE-2026-37236","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46.157Z","modified":"2026-09-08T19:42:20.313Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-37236","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-10-28T02:30:40.342244112Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-37236","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46.157Z","modified":"2026-10-01T03:03:04.488495859Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-37236","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:00Z","modified":"2026-10-17T13:00:02.585938369Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-98253","title":"CVE-2026-37236 affecting package azl-otel-collector 0.127.0-1","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98256","title":"CVE-2026-37236 affecting package cri-o 1.30.1-1","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98343","title":"CVE-2026-37236 affecting package cert-manager for versions less than 1.12.15-14","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98346","title":"CVE-2026-37236 affecting package cf-cli for versions less than 8.7.11-9","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98349","title":"CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98352","title":"CVE-2026-37236 affecting package containerd2 for versions less than 2.3.4-1","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98355","title":"CVE-2026-37236 affecting package cri-tools for versions less than 1.32.0-8","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98358","title":"CVE-2026-37236 affecting package docker-buildx for versions less than 0.14.0-17","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98361","title":"CVE-2026-37236 affecting package docker-compose for versions less than 2.27.0-14","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98364","title":"CVE-2026-37236 affecting package etcd for versions less than 3.5.35-1","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-06T14:17:26.738074304Z","updated_at":"2026-11-06T14:57:15.495576Z"},{"id":"AZL-98367","title":"CVE-2026-37236 affecting package flannel for versions less than 0.24.2-32","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98373","title":"CVE-2026-37236 affecting package keda for versions less than 2.14.1-19","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-98376","title":"CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98379","title":"CVE-2026-37236 affecting package kubernetes for versions less than 1.30.10-30","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98385","title":"CVE-2026-37236 affecting package moby-containerd-cc for versions less than 1.7.7-17","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98388","title":"CVE-2026-37236 affecting package moby-engine for versions less than 25.0.18-1","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98391","title":"CVE-2026-37236 affecting package opa 0.63.0-5","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-09-16T06:39:01Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-98394","title":"CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98436","title":"CVE-2026-37236 affecting package telegraf for versions less than 1.31.0-33","description":"grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.","status":"published","published":"2026-08-28T16:17:46Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"openSUSE-SU-2026:11667-1","title":"hauler-2.1.0-1.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:08.676223436Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11669-1","title":"helm3-3.21.3-7.1 on GA media","description":"These are all security issues fixed in the helm3-3.21.3-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:09.53062348Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11676-1","title":"trivy-0.74.0-2.1 on GA media","description":"These are all security issues fixed in the trivy-0.74.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:09.812788317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11697-1","title":"distribution-registry-3.1.1-6.1 on GA media","description":"These are all security issues fixed in the distribution-registry-3.1.1-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.528369322Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11718-1","title":"helm-4.2.4-3.1 on GA media","description":"These are all security issues fixed in the helm-4.2.4-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:05.699036592Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11803-1","title":"alloy-1.19.2-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-09-18T18:23:08.624887714Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11828-1","title":"amazon-cloudwatch-agent-1.300072.0-1.1 on GA media","description":"These are all security issues fixed in the amazon-cloudwatch-agent-1.300072.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:08.581330571Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21793-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.1.0 (bsc#1265425, CVE-2026-41888):\n  * `v2.1.0` is a **minor** release built on the containerd-\n    native foundation laid down in `v2.0.0`. The headline is that\n    `hauler store sync` and `hauler store add` are now fully\n    concurrent, with signature verification pinned to digests and\n    running in parallel too. Alongside that, this release adds an\n    audit trail, a store integrity checker, store-to-manifest\n    generation, private/insecure registry support across every\n    pull path, and a set of fixes for containerd imports, chunked\n    hauls, and Docker Hub reference handling.\n  * **Notable dependency bumps:** Go → **1.26.6**;\n    `containerd/v2` → 2.3.4; `sigstore/cosign/v3` → 3.1.3;\n    `sigstore/sigstore` → 1.10.9; `go-containerregistry` →\n    0.22.0; `helm/v4` → 4.2.4; `k8s.io` libs (apimachinery, api,\n    client-go) → 0.37.0; `logrus` → 1.10.2; `docker/go-metrics` →\n    0.1.0; `sigstore/rekor` → 1.5.4 (CVE resolution); plus\n    `x/mod` and `go-isatty`.\n\n- update to 2.0.3 (bsc#1276124,\n  CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):\n  * Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport\n    #688)\n  * Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the\n    go_modules group across 1 directory (backport #691)\n  * fix for homebrew macOS binary quarantine (backport #690)\n  * fix: process Helm deps before --add-images discovery\n    (backport #703)\n  * update hauler store remove to handle registry reference as\n    part of string (backport #705)\n  * fixed vuln for golang grpc\n","status":"published","published":"2026-09-03T12:32:31Z","modified":"2026-09-09T18:23:15.8738835Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA\n  certificates (bsc#1258543).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278624).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279390).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1279392).\n","status":"published","published":"2026-09-07T15:03:57Z","modified":"2026-09-10T18:23:46.123242111Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21809-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.21.1:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-08T14:29:32Z","modified":"2026-09-10T18:23:23.371750044Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21898-1","title":"Security update for distribution","description":"This update for distribution fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278997).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278997).\n","status":"published","published":"2026-09-21T12:26:04Z","modified":"2026-09-25T18:23:11.823190119Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:15:27Z","modified":"2026-10-09T17:23:14.415693669Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23456-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-04T08:39:53Z","modified":"2026-09-14T18:23:11.956813324Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23506-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.21.1:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-08T14:29:35Z","modified":"2026-09-14T18:23:17.003123411Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23522-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-04T09:08:39Z","modified":"2026-09-15T18:23:09.030519108Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23688-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.21.1:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-08T14:29:35Z","modified":"2026-09-29T18:23:12.089974044Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23852-1","title":"Security update for distribution","description":"This update for distribution fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278997).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278997).\n","status":"published","published":"2026-09-21T12:23:04Z","modified":"2026-09-27T18:23:15.79036041Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23864-1","title":"Security update for distribution","description":"This update for distribution fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278997).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278997).\n","status":"published","published":"2026-09-21T12:23:04Z","modified":"2026-09-27T18:23:16.588528475Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24148-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:07:44Z","modified":"2026-10-16T17:23:10.706600173Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4045-1","title":"Security update for amazon-cloudwatch-agent","description":"This update for amazon-cloudwatch-agent fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277995).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276739).\n","status":"published","published":"2026-09-07T13:52:56Z","modified":"2026-09-13T18:23:18.00895267Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4175-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n","status":"published","published":"2026-09-14T10:28:51Z","modified":"2026-09-15T17:00:05.668290165Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4408-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\n- Update to version 1.19.2.\n- Update to version 1.19.1.\n- Update to version 1.19.0:\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n- Update to version 1.18.1:\n * Add nop receiver to OTel Engine\n","status":"published","published":"2026-10-01T07:07:12Z","modified":"2026-10-01T17:30:06.30494489Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}