{"id":"CVE-2026-41178","aliases":["ALSA-2026:65116","ALSA-2026:65117","ALSA-2026:66432","ALSA-2026:67148","ALSA-2026:69293","DEBIAN-CVE-2026-41178","EUVD-2026-34288","GHSA-5wrp-cwcj-q835","GO-2026-5158","RHSA-2026:65116","RHSA-2026:65117","RHSA-2026:65336","RHSA-2026:66327","RHSA-2026:66432","RHSA-2026:67138","RHSA-2026:67139","RHSA-2026:67148","RHSA-2026:67974","RHSA-2026:67975","RHSA-2026:68334","RHSA-2026:68335","RHSA-2026:68527","RHSA-2026:68550","RHSA-2026:69293","RLSA-2026:65116","RLSA-2026:65117","RLSA-2026:66432","RLSA-2026:67138","RLSA-2026:67139","RLSA-2026:67148","RLSA-2026:69293","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","SUSE-SU-2026:23456-1","SUSE-SU-2026:23496-1","SUSE-SU-2026:23506-1","SUSE-SU-2026:23522-1","SUSE-SU-2026:23619-1","SUSE-SU-2026:23636-1","SUSE-SU-2026:23688-1","SUSE-SU-2026:23852-1","SUSE-SU-2026:23864-1","SUSE-SU-2026:23876-1","SUSE-SU-2026:23924-1","SUSE-SU-2026:23973-1","SUSE-SU-2026:23984-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:24150-1","SUSE-SU-2026:24282-1","SUSE-SU-2026:3882-1","SUSE-SU-2026:3883-1","SUSE-SU-2026:3928-1","SUSE-SU-2026:4045-1","SUSE-SU-2026:4125-1","SUSE-SU-2026:4175-1","SUSE-SU-2026:4209-1","SUSE-SU-2026:4292-1","SUSE-SU-2026:4293-1","SUSE-SU-2026:4408-1","SUSE-SU-2026:4585-1","SUSE-SU-2026:4600-1","SUSE-SU-2026:5202-1","UBUNTU-CVE-2026-41178","openSUSE-SU-2026:11493-1","openSUSE-SU-2026:11603-1","openSUSE-SU-2026:11604-1","openSUSE-SU-2026:11606-1","openSUSE-SU-2026:11608-1","openSUSE-SU-2026:11609-1","openSUSE-SU-2026:11610-1","openSUSE-SU-2026:11664-1","openSUSE-SU-2026:11667-1","openSUSE-SU-2026:11668-1","openSUSE-SU-2026:11670-1","openSUSE-SU-2026:11676-1","openSUSE-SU-2026:11684-1","openSUSE-SU-2026:11731-1","openSUSE-SU-2026:11732-1","openSUSE-SU-2026:11774-1","openSUSE-SU-2026:11775-1","openSUSE-SU-2026:11776-1","openSUSE-SU-2026:11803-1","openSUSE-SU-2026:11813-1","openSUSE-SU-2026:11847-1","openSUSE-SU-2026:11914-1","openSUSE-SU-2026:12163-1","openSUSE-SU-2026:12292-1","openSUSE-SU-2026:12300-1","openSUSE-SU-2026:21551-1","openSUSE-SU-2026:21674-1","openSUSE-SU-2026:21755-1","openSUSE-SU-2026:21771-1","openSUSE-SU-2026:21786-1","openSUSE-SU-2026:21787-1","openSUSE-SU-2026:21793-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21809-1","openSUSE-SU-2026:21824-1","openSUSE-SU-2026:21882-1","openSUSE-SU-2026:21898-1"],"aliases_more":6,"status":"published","title":"OpenTelemetry-Go's baggage parsing no longer caps raw header length","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00336,"percentile":0.27315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-05-28T17:04:19Z","modified":"2026-11-12T12:27:19Z","fixes":[{"ecosystem":"Go","package":"go.opentelemetry.io/otel/baggage","fixed_in":["1.42.0","1.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/otel/propagation","fixed_in":["1.42.0","1.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"golang-opentelemetry-otel","fixed_in":["1.46.0-2"],"sources":["osv"]},{"ecosystem":"Go","package":"go.opentelemetry.io/otel","fixed_in":["1.42.0","1.44.0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift-hyperkube","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-hyperkube","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-apiserver","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-controller-manager","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-scheduler","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kubelet","fixed_in":["0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-cloud-sap-agent","fixed_in":["3.15-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-cloud-sap-agent","fixed_in":["3.15-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-cloud-sap-agent","fixed_in":["3.15-6.78.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","fixed_in":["1.5.3-150600.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apptainer","fixed_in":["1.5.3-150600.4.40.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"buildpacks-cli","fixed_in":["0.40.9-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","fixed_in":["1.300071.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"azure-storage-azcopy","fixed_in":["10.32.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","fixed_in":["0.60.5-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"coredns","fixed_in":["1.14.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"distribution","fixed_in":["3.1.1-5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm3","fixed_in":["3.21.3-6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apptainer","fixed_in":["1.5.3-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["4.2.4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubernetes1.34","fixed_in":["1.34.11-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubernetes1.35","fixed_in":["1.35.8-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubernetes1.36","fixed_in":["1.36.4-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","fixed_in":["20260918.01-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helmsman","fixed_in":["4.0.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"coredns","fixed_in":["1.14.7-bp160.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"google-cloud-sap-agent","fixed_in":["3.15-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"apptainer","fixed_in":["1.5.3-bp160.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/otel/baggage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.41.0"},{"last_affected":"1.41.0"},{"fixed":"1.42.0"}]}],"versions":["1.41.0"]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/otel/propagation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.41.0"},{"last_affected":"1.41.0"},{"fixed":"1.42.0"}]}],"versions":["1.41.0"]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/otel/baggage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.43.0"},{"last_affected":"1.43.0"},{"fixed":"1.44.0"}]}],"versions":["1.43.0"]},{"source":"ghsa","ecosystem":"Go","package":"go.opentelemetry.io/otel/propagation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.43.0"},{"last_affected":"1.43.0"},{"fixed":"1.44.0"}]}],"versions":["1.43.0"]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.152.1-2.el10_2"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.152.1-2.el9_8"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:10","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165.1-5.el10_2.alma.1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165.1-5.el10_2.alma.1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165.1-5.el10_2.alma.1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101.5-3.el8_10.alma.1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101.5-3.el8_10.alma.1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"101.5-3.el8_10.alma.1"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165.1-5.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165.1-5.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165.1-5.el9_8.alma.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2","1.10.0-1","1.16.0-1","1.16.0-2","1.19.0-0","1.21.0-1","1.21.0-2","1.21.0-3","1.21.0-4","1.31.0-1","1.31.0-2","1.31.0-3","1.31.0-4","1.31.0-5","1.31.0-6","1.43.0-1","1.43.0-2","1.43.0-3","1.43.0-4","1.46.0-1~exp1","1.46.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-4","1.31.0-5","1.31.0-6","1.43.0-1","1.43.0-2","1.43.0-3","1.43.0-4","1.46.0-1~exp1","1.46.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.46.0-2"}]}],"versions":["1.31.0-4","1.31.0-5","1.31.0-6","1.43.0-1","1.43.0-2","1.43.0-3","1.43.0-4","1.46.0-1~exp1"]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel/baggage","ranges":[{"type":"SEMVER","events":[{"introduced":"1.41.0"},{"fixed":"1.42.0"}]}],"versions":["1.41.0"]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel/propagation","ranges":[{"type":"SEMVER","events":[{"introduced":"1.41.0"},{"fixed":"1.42.0"}]}],"versions":["1.41.0"]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel/baggage","ranges":[{"type":"SEMVER","events":[{"introduced":"1.43.0"},{"fixed":"1.44.0"}]}],"versions":["1.43.0"]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel/propagation","ranges":[{"type":"SEMVER","events":[{"introduced":"1.43.0"},{"fixed":"1.44.0"}]}],"versions":["1.43.0"]},{"source":"osv","ecosystem":"Go","package":"go.opentelemetry.io/otel","ranges":[{"type":"SEMVER","events":[{"introduced":"1.41.0"},{"fixed":"1.42.0"},{"introduced":"1.43.0"},{"fixed":"1.44.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el10_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el9_8"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition-grub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.0-7.el9_6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:134.1-12.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"image-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"image-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"image-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"image-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el10_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el9_6"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el9_4"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202609141614.p2.g160626b.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el10_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-2.el9_8"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:10","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el10_2.rocky.0.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"image-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:52.1-2.el10_2.rocky.0.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:101.5-3.el8_10.rocky.0.6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-5.el9_8.rocky.0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.8-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-slfo.1.1_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.93.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-6.78.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300069.0-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-150700.9.14.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150200.3.94.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"system-user-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.5.8.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150400.9.47.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-6","1.43.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-opentelemetry-otel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.31.0-4","1.31.0-5","1.31.0-6"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"buildpacks-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.9-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300071.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.5-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.66","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.66.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubernetes1.34","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.11-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubernetes1.35","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.8-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubernetes1.36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.4-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.9.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260918.01-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helmsman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kumactl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.5-bp160.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp160.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-160000.3.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.9.1-bp160.1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-bp160.1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-bp160.1.1"}]}],"bundled":8}],"products":[{"vendor":"open-telemetry","product":"go.opentelemetry.io/otel/baggage"},{"vendor":"open-telemetry","product":"go.opentelemetry.io/otel/propagation"},{"vendor":"opentelemetry","product":"opentelemetry"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835","tags":["x_refsource_CONFIRM","exploit","Issue Tracking","Patch","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/7880","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41178","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5wrp-cwcj-q835"},{"url":"https://access.redhat.com/errata/RHSA-2026:65116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41178","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://bugzilla.redhat.com/2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/2484830","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515840","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-65116.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65117","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-65117.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66432","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55677","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/2480762","tags":["report"]},{"url":"https://bugzilla.redhat.com/2493622","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-66432.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67148","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22866","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://bugzilla.redhat.com/2344219","tags":["report"]},{"url":"https://bugzilla.redhat.com/2456333","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-67148.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69293","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-69293.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41178.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41178","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65116.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41178","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65117.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65336","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65336.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66327","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-127068","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66327.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493622","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66432.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","tags":["advisory"]},{"url":"https://go.dev/cl/781701","tags":["article"]},{"url":"https://go.dev/issue/79572","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5027","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55677","tags":["advisory"]},{"url":"https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67138","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67138.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67139","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67139.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2344219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67148.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22866","tags":["advisory"]},{"url":"https://go.dev/cl/643735","tags":["article"]},{"url":"https://go.dev/issue/71383","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3447","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67974","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67974.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67975","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67975.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68334","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512562","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68334.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39831","tags":["advisory"]},{"url":"https://go.dev/cl/781662","tags":["article"]},{"url":"https://go.dev/issue/79566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5019","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44740","tags":["advisory"]},{"url":"https://github.com/go-git/go-billy/releases/tag/v5.9.0","tags":["article"]},{"url":"https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","tags":["article"]},{"url":"https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46597","tags":["advisory"]},{"url":"https://go.dev/cl/781620","tags":["article"]},{"url":"https://go.dev/issue/79561","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5013","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","tags":["advisory"]},{"url":"https://go.dev/cl/794100","tags":["article"]},{"url":"https://go.dev/issue/80142","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71556","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab","tags":["article"]},{"url":"https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","tags":["article"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81521","tags":["advisory"]},{"url":"https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68335","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68335.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68527","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68527.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68550","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68550.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69293.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:65116","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:65117","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66432","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67138","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67139","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67148","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69293","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623456-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1272402","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1277949","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63308","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623496-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276612","tags":["report"]},{"url":"https://bugzilla.suse.com/1278013","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81092","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623506-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276644","tags":["report"]},{"url":"https://bugzilla.suse.com/1278270","tags":["report"]},{"url":"https://bugzilla.suse.com/1278273","tags":["report"]},{"url":"https://bugzilla.suse.com/1278688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623522-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623619-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276667","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623636-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623688-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623852-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268884","tags":["report"]},{"url":"https://bugzilla.suse.com/1276677","tags":["report"]},{"url":"https://bugzilla.suse.com/1277966","tags":["report"]},{"url":"https://bugzilla.suse.com/1278997","tags":["report"]},{"url":"https://bugzilla.suse.com/1279219","tags":["report"]},{"url":"https://bugzilla.suse.com/1279316","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623864-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276722","tags":["report"]},{"url":"https://bugzilla.suse.com/1278597","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623924-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624150-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276744","tags":["report"]},{"url":"https://bugzilla.suse.com/1279231","tags":["report"]},{"url":"https://bugzilla.suse.com/1279329","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263882-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263883-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263928-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276731","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264045-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276739","tags":["report"]},{"url":"https://bugzilla.suse.com/1277995","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276733","tags":["report"]},{"url":"https://bugzilla.suse.com/1279026","tags":["report"]},{"url":"https://bugzilla.suse.com/1279223","tags":["report"]},{"url":"https://bugzilla.suse.com/1279330","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264175-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264209-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248946","tags":["report"]},{"url":"https://bugzilla.suse.com/1262952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265799","tags":["report"]},{"url":"https://bugzilla.suse.com/1266179","tags":["report"]},{"url":"https://bugzilla.suse.com/1266639","tags":["report"]},{"url":"https://bugzilla.suse.com/1267176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272064","tags":["report"]},{"url":"https://bugzilla.suse.com/1276687","tags":["report"]},{"url":"https://bugzilla.suse.com/1278621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264292-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272118","tags":["report"]},{"url":"https://bugzilla.suse.com/1278967","tags":["report"]},{"url":"https://bugzilla.suse.com/1279297","tags":["report"]},{"url":"https://bugzilla.suse.com/1279414","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264293-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264600-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265202-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283762","tags":["report"]},{"url":"https://bugzilla.suse.com/1285297","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-41178","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://bugzilla.suse.com/1276712","tags":["report"]},{"url":"https://bugzilla.suse.com/1266645","tags":["report"]},{"url":"https://bugzilla.suse.com/1276727","tags":["report"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1276124","tags":["report"]},{"url":"https://bugzilla.suse.com/1276651","tags":["report"]},{"url":"https://bugzilla.suse.com/1277965","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72817","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]},{"url":"https://bugzilla.suse.com/1238699","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241838","tags":["report"]},{"url":"https://bugzilla.suse.com/1251495","tags":["report"]},{"url":"https://bugzilla.suse.com/1251689","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1260295","tags":["report"]},{"url":"https://bugzilla.suse.com/1262269","tags":["report"]},{"url":"https://bugzilla.suse.com/1279234","tags":["report"]},{"url":"https://bugzilla.suse.com/1279315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://bugzilla.suse.com/1266208","tags":["report"]},{"url":"https://bugzilla.suse.com/1276703","tags":["report"]},{"url":"https://bugzilla.suse.com/1278643","tags":["report"]},{"url":"https://bugzilla.suse.com/1271215","tags":["report"]},{"url":"https://bugzilla.suse.com/1276707","tags":["report"]},{"url":"https://bugzilla.suse.com/1276755","tags":["report"]},{"url":"https://bugzilla.suse.com/1278962","tags":["report"]},{"url":"https://bugzilla.suse.com/1279208","tags":["report"]},{"url":"https://bugzilla.suse.com/1279310","tags":["report"]},{"url":"https://bugzilla.suse.com/1283727","tags":["report"]},{"url":"https://bugzilla.suse.com/1285291","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41178","title":"OpenTelemetry-Go's baggage parsing no longer caps raw header length","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","status":"published","published":"2026-06-04T14:38:23.707Z","modified":"2026-06-04T15:46:11.923Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-34288","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","status":"published","published":"2026-06-04T14:38:23Z","modified":"2026-06-04T15:46:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:52.744481Z"}],"ghsa":[{"id":"GHSA-5wrp-cwcj-q835","title":"opentelemetry-go's baggage parsing no longer caps raw header length","description":"### Summary\n\nhttps://github.com/open-telemetry/opentelemetry-go/pull/7880 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs.\n\n\n### Details\n\nThe commit removes the upfront baggage-string length check and the per-member size guard in parsing. `Parse` now walks the entire input with `strings.SplitSeq` and skips invalid members while continuing to process the rest. For very large or malformed `baggage` headers, the parser still fully tokenizes and percent-decodes each member, and errors are forwarded to the global error handler (default logging). This lets a remote client send oversized/invalid headers to trigger excessive CPU/memory work and potentially large log output before any size limit is enforced, creating a denial-of-service risk in services that do not already enforce strict header size limits.\n\nSummary:\n- In `baggage/baggage.go`, `parseMember` performs full parsing and `PathUnescape` on the entire member without any size guard, amplifying work for large inputs. `Parse` no longer checks bStr length and continues processing invalid members, so oversized/invalid headers are fully parsed instead of being rejected early.\n- In `propagation/baggage.go`, parsing errors from attacker-controlled headers are sent to the global error handler (default logging), which can amplify oversized-input impact.\n\n### PoC\n\n[baggage_dos_poc.tar.gz](https://github.com/user-attachments/files/26677819/baggage_dos_poc.tar.gz)\n\n### Impact\n\nThe issue is reachable through standard propagation parsing (in-scope) and can be exploited remotely to cause CPU/log amplification, but the impact is availability-only and bounded by transport header limits and configurable error handling, supporting a medium severity rather than high/critical.\n\n`baggage.Parse` iterates over all list members with `strings.SplitSeq` and skips invalid members while continuing, without a raw-length guard. `parseMember` performs full parsing and `PathUnescape` on each member, and `propagation.Baggage` forwards parsing errors to the global error handler, which logs by default. A remote client can therefore send oversized/invalid baggage headers that bypass the 8KB limit for valid members, causing extra CPU work and large log output, resulting in availability/log amplification in services that accept large headers and use the default handler.\n\nAssumptions:\n\n- An instrumented service uses the OpenTelemetry baggage propagator for inbound request parsing.\n- Attackers can send oversized or malformed baggage headers that pass the hosting server/proxy header size limits.\n- The default error handler is used or logs are otherwise emitted for parse errors.\n- Inbound request parsing with propagation.Baggage\n- Oversized/invalid baggage headers accepted by the HTTP/gRPC stack\n- Error handler not suppressing parse errors","status":"published","published":"2026-05-28T17:04:19Z","modified":"2026-06-09T11:53:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-41178","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","status":"published","published":"2026-06-04T16:16:37.297Z","modified":"2026-07-22T20:10:00.127Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-41178","title":"OpenTelemetry-Go's baggage parsing no longer caps raw header length","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","status":"published","published":"2026-06-04T14:38:23.707Z","modified":"2026-11-12T12:27:19.206575974Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-12T12:48:34.460153Z"},{"id":"DEBIAN-CVE-2026-41178","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","status":"published","published":"2026-06-04T16:16:37.297Z","modified":"2026-10-09T05:00:07.012342117Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-5wrp-cwcj-q835","title":"opentelemetry-go's baggage parsing no longer caps raw header length","description":"### Summary\n\nhttps://github.com/open-telemetry/opentelemetry-go/pull/7880 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs.\n\n\n### Details\n\nThe commit removes the upfront baggage-string length check and the per-member size guard in parsing. `Parse` now walks the entire input with `strings.SplitSeq` and skips invalid members while continuing to process the rest. For very large or malformed `baggage` headers, the parser still fully tokenizes and percent-decodes each member, and errors are forwarded to the global error handler (default logging). This lets a remote client send oversized/invalid headers to trigger excessive CPU/memory work and potentially large log output before any size limit is enforced, creating a denial-of-service risk in services that do not already enforce strict header size limits.\n\nSummary:\n- In `baggage/baggage.go`, `parseMember` performs full parsing and `PathUnescape` on the entire member without any size guard, amplifying work for large inputs. `Parse` no longer checks bStr length and continues processing invalid members, so oversized/invalid headers are fully parsed instead of being rejected early.\n- In `propagation/baggage.go`, parsing errors from attacker-controlled headers are sent to the global error handler (default logging), which can amplify oversized-input impact.\n\n### PoC\n\n[baggage_dos_poc.tar.gz](https://github.com/user-attachments/files/26677819/baggage_dos_poc.tar.gz)\n\n### Impact\n\nThe issue is reachable through standard propagation parsing (in-scope) and can be exploited remotely to cause CPU/log amplification, but the impact is availability-only and bounded by transport header limits and configurable error handling, supporting a medium severity rather than high/critical.\n\n`baggage.Parse` iterates over all list members with `strings.SplitSeq` and skips invalid members while continuing, without a raw-length guard. `parseMember` performs full parsing and `PathUnescape` on each member, and `propagation.Baggage` forwards parsing errors to the global error handler, which logs by default. A remote client can therefore send oversized/invalid baggage headers that bypass the 8KB limit for valid members, causing extra CPU work and large log output, resulting in availability/log amplification in services that accept large headers and use the default handler.\n\nAssumptions:\n\n- An instrumented service uses the OpenTelemetry baggage propagator for inbound request parsing.\n- Attackers can send oversized or malformed baggage headers that pass the hosting server/proxy header size limits.\n- The default error handler is used or logs are otherwise emitted for parse errors.\n- Inbound request parsing with propagation.Baggage\n- Oversized/invalid baggage headers accepted by the HTTP/gRPC stack\n- Error handler not suppressing parse errors","status":"published","published":"2026-05-28T17:04:19Z","modified":"2026-09-10T03:51:04.741693305Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RHSA-2026:65116","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-09-09T10:20:18Z","modified":"2026-10-20T10:13:06Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65117","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-09-09T10:20:19Z","modified":"2026-10-20T10:13:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65336","title":"Red Hat Security Advisory: ignition security update","status":"published","published":"2026-09-09T10:20:27Z","modified":"2026-10-20T10:13:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:66327","title":"Red Hat Security Advisory: osbuild-composer security, bug fix, and enhancement update","status":"published","published":"2026-09-10T10:17:17Z","modified":"2026-10-20T10:13:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66432","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-09-11T10:15:13Z","modified":"2026-10-20T10:13:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67138","title":"Red Hat Security Advisory: image-builder security update","status":"published","published":"2026-09-14T10:10:13Z","modified":"2026-10-20T10:13:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67139","title":"Red Hat Security Advisory: image-builder security update","status":"published","published":"2026-09-14T10:10:13Z","modified":"2026-10-20T10:13:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67148","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-09-14T10:10:16Z","modified":"2026-10-20T10:13:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67974","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-09-17T10:18:10Z","modified":"2026-10-20T10:14:08Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67975","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-09-17T10:18:11Z","modified":"2026-10-20T10:14:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68334","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","status":"published","published":"2026-09-17T10:18:18Z","modified":"2026-10-20T10:14:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68335","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","status":"published","published":"2026-09-17T10:18:18Z","modified":"2026-10-20T10:14:11Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68527","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-09-18T10:15:20Z","modified":"2026-10-20T10:14:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68550","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.15 packages and security update","status":"published","published":"2026-09-23T10:14:39Z","modified":"2026-10-20T10:14:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69293","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-09-22T10:19:57Z","modified":"2026-10-20T10:14:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:65116","title":"Important: opentelemetry-collector security update","description":"Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry\n\nSecurity Fix(es):\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\n* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-09T12:09:16.585859Z","modified":"2026-09-09T12:30:03.338221456Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:65117","title":"Important: opentelemetry-collector security update","description":"Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry\n\nSecurity Fix(es):\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\n* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-09T12:05:17.368443Z","modified":"2026-09-09T12:30:03.356053462Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:66432","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n\n* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\n* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:09:43.14217Z","modified":"2026-09-11T12:30:03.623328575Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67138","title":"Important: image-builder security update","description":"A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n\n* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T18:05:37.908911Z","modified":"2026-09-15T18:30:36.365566166Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67139","title":"Important: image-builder security update","description":"A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n\n* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T12:08:56.876794Z","modified":"2026-09-15T12:30:03.317406822Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67148","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)\n\n* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\n* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T06:01:32.512697Z","modified":"2026-09-15T06:30:02.550297942Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69293","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n\n* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n\n* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n\n* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T18:04:11.996091Z","modified":"2026-09-22T18:24:41.508372441Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-41178","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.","status":"published","published":"2026-06-04T16:16:00Z","modified":"2026-11-09T12:49:51.17868675Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"ALSA-2026:65116","title":"Important: opentelemetry-collector security update","description":"Collector with the supported components for a AlmaLinux build of OpenTelemetry  \n\nSecurity Fix(es):  \n\n  * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n  * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n  * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n  * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n  * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n  * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n  * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n  * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n  * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-10-29T11:30:41.205299506Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:65117","title":"Important: opentelemetry-collector security update","description":"Collector with the supported components for a AlmaLinux build of OpenTelemetry  \n\nSecurity Fix(es):  \n\n  * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n  * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n  * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n  * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n  * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n  * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n  * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n  * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n  * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-10-29T11:32:37.161964963Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:66432","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n  * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n  * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n  * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n  * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-10-29T11:30:41.65434244Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67148","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)\n  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)\n  * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n  * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)\n  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n  * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-29T11:02:29.319203968Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69293","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n  * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n  * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n  * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:32:32.031380054Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"GO-2026-5158","title":"Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel","description":"Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel","status":"published","published":"2026-07-24T18:35:55Z","modified":"2026-07-27T21:59:42.805474793Z","updated_at":"2026-11-02T15:47:02.556545Z"},{"id":"openSUSE-SU-2026:11493-1","title":"buildpacks-cli-0.40.9-1.1 on GA media","description":"These are all security issues fixed in the buildpacks-cli-0.40.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-08-12T10:45:07.129919827Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11603-1","title":"amazon-cloudwatch-agent-1.300071.0-2.1 on GA media","description":"These are all security issues fixed in the amazon-cloudwatch-agent-1.300071.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:49.760174067Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11604-1","title":"azure-storage-azcopy-10.32.7-1.1 on GA media","description":"These are all security issues fixed in the azure-storage-azcopy-10.32.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:49.761564136Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11606-1","title":"cadvisor-0.60.5-2.1 on GA media","description":"These are all security issues fixed in the cadvisor-0.60.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:48.673365379Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11608-1","title":"coredns-1.14.7-1.1 on GA media","description":"These are all security issues fixed in the coredns-1.14.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:02:03.187593773Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11609-1","title":"distribution-registry-3.1.1-5.1 on GA media","description":"These are all security issues fixed in the distribution-registry-3.1.1-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:02:03.288743621Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11610-1","title":"helm3-3.21.3-6.1 on GA media","description":"These are all security issues fixed in the helm3-3.21.3-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:51.561551991Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11664-1","title":"apptainer-1.5.3-3.1 on GA media","description":"These are all security issues fixed in the apptainer-1.5.3-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:08.67048571Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11667-1","title":"hauler-2.1.0-1.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:08.676223436Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11668-1","title":"helm-4.2.4-1.1 on GA media","description":"These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:09.519832649Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11670-1","title":"mcphost-0.34.0-10.1 on GA media","description":"These are all security issues fixed in the mcphost-0.34.0-10.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:08.663871546Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11676-1","title":"trivy-0.74.0-2.1 on GA media","description":"These are all security issues fixed in the trivy-0.74.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:09.812788317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11684-1","title":"grafana-12.4.10-1.1 on GA media","description":"These are all security issues fixed in the grafana-12.4.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.952740239Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11731-1","title":"containerized-data-importer1.65-api-1.65.0-3.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:22.462847721Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11732-1","title":"containerized-data-importer1.66-api-1.66.1-1.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:18.656014419Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11774-1","title":"kubernetes1.34-apiserver-1.34.11-2.1 on GA media","description":"These are all security issues fixed in the kubernetes1.34-apiserver-1.34.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:04.08894847Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11775-1","title":"kubernetes1.35-apiserver-1.35.8-2.1 on GA media","description":"These are all security issues fixed in the kubernetes1.35-apiserver-1.35.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:04.992856467Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11776-1","title":"kubernetes1.36-apiserver-1.36.4-2.1 on GA media","description":"These are all security issues fixed in the kubernetes1.36-apiserver-1.36.4-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:04.986418791Z","updated_at":"2026-11-02T16:58:39.516824Z"}]},"sources_more":{"osv":56}}