{"id":"CVE-2026-41602","aliases":["ALPINE-CVE-2026-41602","AZL-85017","AZL-85220","AZL-85223","AZL-85226","AZL-85229","AZL-85292","BIT-thrift-2026-41602","DEBIAN-CVE-2026-41602","EUVD-2026-26020","GHSA-wf45-q9ch-q8gh","ROOT-APP-GOBINARY-CVE-2026-41602","SUSE-SU-2026:21852-1","SUSE-SU-2026:2243-1","SUSE-SU-2026:2258-1","SUSE-SU-2026:2438-1","SUSE-SU-2026:2768-1","SUSE-SU-2026:2774-1","SUSE-SU-2026:3056-1","SUSE-SU-2026:3057-1","UBUNTU-CVE-2026-41602","openSUSE-SU-2026:10685-1","openSUSE-SU-2026:10692-1","openSUSE-SU-2026:10699-1","openSUSE-SU-2026:10744-1","openSUSE-SU-2026:20816-1","openSUSE-SU-2026:20940-1"],"status":"published","title":"Apache Thrift: Go TFramedTransport uint32 overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01163,"percentile":0.67639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-04-28T09:19:06Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"github.com/apache/thrift","fixed_in":["0.23.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"thrift","fixed_in":["0.23.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"thrift","fixed_in":["0.15.0-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"influxdb","fixed_in":["2.7.5-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["3.19.1.kata3-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-12"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-22"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"thrift","fixed_in":["0.23.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thrift","fixed_in":["0.23.0-3"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/apache/thrift","fixed_in":["v0.21.0-aikido.3","v0.22.0-aikido.2","v0.21.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/apache/thrift","fixed_in":["v0.21.0-root.io.1","v0.22.0-root.io.1","v0.21.0-root.io.3","v0.22.0-root.io.2","v0.21.0-root.io.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["11.6.14+security01-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","fixed_in":["1.300066.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/apache/thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.27.0~preview2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1.kata3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-22"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"thrift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-2","0.17.0-3","0.17.0-4","0.18.1-1","0.18.1-2","0.19.0-1","0.19.0-2","0.19.0-2.1","0.19.0-2.1~exp1","0.19.0-3","0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2","0.23.0-3","0.24.0-1","0.24.0-2","0.24.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2","0.23.0-3","0.24.0-1","0.24.0-2","0.24.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-3"}]}],"versions":["0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2"]},{"source":"osv","ecosystem":"Go","package":"github.com/apache/thrift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/apache/thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.21.0-aikido.3"},{"fixed":"v0.22.0-aikido.2"},{"fixed":"v0.21.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/apache/thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.21.0-root.io.1"},{"fixed":"v0.22.0-root.io.1"},{"fixed":"v0.21.0-root.io.3"},{"fixed":"v0.22.0-root.io.2"},{"fixed":"v0.21.0-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150700.15.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.9.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.11.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-150002.3.13.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-150002.4.21.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.11.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-150002.3.3.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"python-defusedxml-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-150002.1.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.8-150002.3.12.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150002.3.3.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.6.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.12-150002.3.17.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150002.3.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-150002.3.6.2"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.12-150002.3.17.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.22"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.25"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.11"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-150700.3.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.22.10"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.12"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.34"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-8.20.13"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-6.24.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-9.20.24"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.29-150700.3.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.14.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.14.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-6","0.13.0-2build1","0.13.0-2build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.0-6ubuntu1","0.13.0-6ubuntu2","0.13.0-6ubuntu3","0.13.0-7","0.16.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-4","0.19.0-2","0.19.0-2build1","0.19.0-2.1build4","0.19.0-2.1build5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0-3ubuntu1","0.23.0-3","0.23.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1","0.22.0-3","0.22.0-3ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300066.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-bp160.1.1"}]}],"bundled":24}],"products":[{"vendor":"apache","product":"thrift"},{"vendor":"apache software foundation","product":"apache thrift"},{"vendor":"red hat","product":"multicluster global hub"},{"vendor":"red hat","product":"multicluster global hub 1.3.4"},{"vendor":"red hat","product":"multicluster global hub 1.4.5"},{"vendor":"red hat","product":"multicluster global hub 1.6.5"},{"vendor":"red hat","product":"multicluster global hub 1.7.0"},{"vendor":"red hat","product":"openshift service mesh 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ceph storage 5"},{"vendor":"red hat","product":"red hat ceph storage 6"},{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat multicluster global hub 1.5.3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3.9.3"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","tags":["vendor-advisory","Mailing List","Patch","Release Notes","fix","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/28/6","tags":["Mailing List","discussion","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41602","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463407","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41602.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24503","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25273","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14162","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14885","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41602","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wf45-q9ch-q8gh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41602","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41602.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41602","tags":["advisory"]},{"url":"https://github.com/apache/thrift","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621852-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262955","tags":["report"]},{"url":"https://bugzilla.suse.com/1263530","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1248707","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://bugzilla.suse.com/1259999","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260267","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1260881","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://bugzilla.suse.com/1261810","tags":["report"]},{"url":"https://bugzilla.suse.com/1262222","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://bugzilla.suse.com/1263986","tags":["report"]},{"url":"https://bugzilla.suse.com/1263987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262258-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262438-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258099","tags":["report"]},{"url":"https://bugzilla.suse.com/1258609","tags":["report"]},{"url":"https://bugzilla.suse.com/1259919","tags":["report"]},{"url":"https://bugzilla.suse.com/1260317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4427","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262768-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1229105","tags":["report"]},{"url":"https://bugzilla.suse.com/1232641","tags":["report"]},{"url":"https://bugzilla.suse.com/1249400","tags":["report"]},{"url":"https://bugzilla.suse.com/1249532","tags":["report"]},{"url":"https://bugzilla.suse.com/1253174","tags":["report"]},{"url":"https://bugzilla.suse.com/1259739","tags":["report"]},{"url":"https://bugzilla.suse.com/1260806","tags":["report"]},{"url":"https://bugzilla.suse.com/1260870","tags":["report"]},{"url":"https://bugzilla.suse.com/1260905","tags":["report"]},{"url":"https://bugzilla.suse.com/1261902","tags":["report"]},{"url":"https://bugzilla.suse.com/1262409","tags":["report"]},{"url":"https://bugzilla.suse.com/1262708","tags":["report"]},{"url":"https://bugzilla.suse.com/1262760","tags":["report"]},{"url":"https://bugzilla.suse.com/1263157","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266012","tags":["report"]},{"url":"https://bugzilla.suse.com/1266556","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1267153","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262774-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226578","tags":["report"]},{"url":"https://bugzilla.suse.com/1234567","tags":["report"]},{"url":"https://bugzilla.suse.com/1238890","tags":["report"]},{"url":"https://bugzilla.suse.com/1242916","tags":["report"]},{"url":"https://bugzilla.suse.com/1245107","tags":["report"]},{"url":"https://bugzilla.suse.com/1247707","tags":["report"]},{"url":"https://bugzilla.suse.com/1249243","tags":["report"]},{"url":"https://bugzilla.suse.com/1253032","tags":["report"]},{"url":"https://bugzilla.suse.com/1254900","tags":["report"]},{"url":"https://bugzilla.suse.com/1257583","tags":["report"]},{"url":"https://bugzilla.suse.com/1257894","tags":["report"]},{"url":"https://bugzilla.suse.com/1258041","tags":["report"]},{"url":"https://bugzilla.suse.com/1258079","tags":["report"]},{"url":"https://bugzilla.suse.com/1258144","tags":["report"]},{"url":"https://bugzilla.suse.com/1258382","tags":["report"]},{"url":"https://bugzilla.suse.com/1258816","tags":["report"]},{"url":"https://bugzilla.suse.com/1259087","tags":["report"]},{"url":"https://bugzilla.suse.com/1259230","tags":["report"]},{"url":"https://bugzilla.suse.com/1259261","tags":["report"]},{"url":"https://bugzilla.suse.com/1259474","tags":["report"]},{"url":"https://bugzilla.suse.com/1259479","tags":["report"]},{"url":"https://bugzilla.suse.com/1259482","tags":["report"]},{"url":"https://bugzilla.suse.com/1259521","tags":["report"]},{"url":"https://bugzilla.suse.com/1259590","tags":["report"]},{"url":"https://bugzilla.suse.com/1259591","tags":["report"]},{"url":"https://bugzilla.suse.com/1259700","tags":["report"]},{"url":"https://bugzilla.suse.com/1259787","tags":["report"]},{"url":"https://bugzilla.suse.com/1259960","tags":["report"]},{"url":"https://bugzilla.suse.com/1260031","tags":["report"]},{"url":"https://bugzilla.suse.com/1260614","tags":["report"]},{"url":"https://bugzilla.suse.com/1261305","tags":["report"]},{"url":"https://bugzilla.suse.com/1261307","tags":["report"]},{"url":"https://bugzilla.suse.com/1261327","tags":["report"]},{"url":"https://bugzilla.suse.com/1261631","tags":["report"]},{"url":"https://bugzilla.suse.com/1261723","tags":["report"]},{"url":"https://bugzilla.suse.com/1261753","tags":["report"]},{"url":"https://bugzilla.suse.com/1261841","tags":["report"]},{"url":"https://bugzilla.suse.com/1262090","tags":["report"]},{"url":"https://bugzilla.suse.com/1262285","tags":["report"]},{"url":"https://bugzilla.suse.com/1262460","tags":["report"]},{"url":"https://bugzilla.suse.com/1262471","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262595","tags":["report"]},{"url":"https://bugzilla.suse.com/1262720","tags":["report"]},{"url":"https://bugzilla.suse.com/1262761","tags":["report"]},{"url":"https://bugzilla.suse.com/1263814","tags":["report"]},{"url":"https://bugzilla.suse.com/1263841","tags":["report"]},{"url":"https://bugzilla.suse.com/1264149","tags":["report"]},{"url":"https://bugzilla.suse.com/1264174","tags":["report"]},{"url":"https://bugzilla.suse.com/1264234","tags":["report"]},{"url":"https://bugzilla.suse.com/1264256","tags":["report"]},{"url":"https://bugzilla.suse.com/1264966","tags":["report"]},{"url":"https://bugzilla.suse.com/1265134","tags":["report"]},{"url":"https://bugzilla.suse.com/1265319","tags":["report"]},{"url":"https://bugzilla.suse.com/1265358","tags":["report"]},{"url":"https://bugzilla.suse.com/1265975","tags":["report"]},{"url":"https://bugzilla.suse.com/1269253","tags":["report"]},{"url":"https://bugzilla.suse.com/1269534","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42198","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208300","tags":["report"]},{"url":"https://bugzilla.suse.com/1241030","tags":["report"]},{"url":"https://bugzilla.suse.com/1241033","tags":["report"]},{"url":"https://bugzilla.suse.com/1241728","tags":["report"]},{"url":"https://bugzilla.suse.com/1251365","tags":["report"]},{"url":"https://bugzilla.suse.com/1251559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253508","tags":["report"]},{"url":"https://bugzilla.suse.com/1253517","tags":["report"]},{"url":"https://bugzilla.suse.com/1253797","tags":["report"]},{"url":"https://bugzilla.suse.com/1253799","tags":["report"]},{"url":"https://bugzilla.suse.com/1253980","tags":["report"]},{"url":"https://bugzilla.suse.com/1253983","tags":["report"]},{"url":"https://bugzilla.suse.com/1258096","tags":["report"]},{"url":"https://bugzilla.suse.com/1260139","tags":["report"]},{"url":"https://bugzilla.suse.com/1260149","tags":["report"]},{"url":"https://bugzilla.suse.com/1260180","tags":["report"]},{"url":"https://bugzilla.suse.com/1263247","tags":["report"]},{"url":"https://bugzilla.suse.com/1263313","tags":["report"]},{"url":"https://bugzilla.suse.com/1263357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263411","tags":["report"]},{"url":"https://bugzilla.suse.com/1263445","tags":["report"]},{"url":"https://bugzilla.suse.com/1263515","tags":["report"]},{"url":"https://bugzilla.suse.com/1263606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264862","tags":["report"]},{"url":"https://bugzilla.suse.com/1264888","tags":["report"]},{"url":"https://bugzilla.suse.com/1264938","tags":["report"]},{"url":"https://bugzilla.suse.com/1266051","tags":["report"]},{"url":"https://bugzilla.suse.com/1266057","tags":["report"]},{"url":"https://bugzilla.suse.com/1266086","tags":["report"]},{"url":"https://bugzilla.suse.com/1266112","tags":["report"]},{"url":"https://bugzilla.suse.com/1266122","tags":["report"]},{"url":"https://bugzilla.suse.com/1266127","tags":["report"]},{"url":"https://bugzilla.suse.com/1266132","tags":["report"]},{"url":"https://bugzilla.suse.com/1266150","tags":["report"]},{"url":"https://bugzilla.suse.com/1266160","tags":["report"]},{"url":"https://bugzilla.suse.com/1266477","tags":["report"]},{"url":"https://bugzilla.suse.com/1266482","tags":["report"]},{"url":"https://bugzilla.suse.com/1266541","tags":["report"]},{"url":"https://bugzilla.suse.com/1266547","tags":["report"]},{"url":"https://bugzilla.suse.com/1267058","tags":["report"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263057-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41602","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41602","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-41602","title":"Apache Thrift: Go TFramedTransport uint32 overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:19:06.646Z","modified":"2026-09-09T12:04:46.718Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190","CWE-190"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-26020","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:19:06Z","modified":"2026-09-09T12:04:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-wf45-q9ch-q8gh","title":"Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T12:31:30Z","modified":"2026-05-06T19:57:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"nvd":[{"id":"CVE-2026-41602","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"ALPINE-CVE-2026-41602","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-11-03T06:33:02.761836602Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-41602","title":"Apache Thrift: Go TFramedTransport uint32 overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:19:06.646Z","modified":"2026-10-28T02:30:34.784326664Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41602","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation  This issue affects Apache Thrift: before 0.23.0.  Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-10-27T10:01:19.550074555Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-wf45-q9ch-q8gh","title":"Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T12:31:30Z","modified":"2026-09-10T03:51:03.775500677Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-41602","title":"CVE-2026-41602 in github.com/apache/thrift - Patched by Root","description":"Root has patched CVE-2026-41602 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-09-08T12:26:15Z","modified":"2026-09-08T13:15:03.484695544Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-41602","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:00Z","modified":"2026-10-17T12:58:15.402038826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-85017","title":"CVE-2026-41602 affecting package thrift for versions less than 0.15.0-6","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-08-28T17:56:31.769648Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"AZL-85220","title":"CVE-2026-41602 affecting package kata-containers-preview 3.27.0~preview2-2","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"AZL-85223","title":"CVE-2026-41602 affecting package influxdb for versions less than 2.7.5-17","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-09-22T05:34:53Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"AZL-85226","title":"CVE-2026-41602 affecting package kata-containers for versions less than 3.19.1.kata3-4","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"AZL-85229","title":"CVE-2026-41602 affecting package kata-containers-cc for versions less than 3.15.0.aks0-12","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"AZL-85292","title":"CVE-2026-41602 affecting package telegraf for versions less than 1.31.0-22","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-08-28T17:56:59.219308Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"BIT-thrift-2026-41602","title":"Apache Thrift: Go TFramedTransport uint32 overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-29T08:50:18.674Z","modified":"2026-09-08T08:48:20.84260387Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"openSUSE-SU-2026:10685-1","title":"libthrift-0_23_0-0.23.0-1.1 on GA media","description":"These are all security issues fixed in the libthrift-0_23_0-0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:47:08.345774Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10692-1","title":"grafana-11.6.14+security01-3.1 on GA media","description":"These are all security issues fixed in the grafana-11.6.14+security01-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-05-06T08:00:58.443302Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10699-1","title":"amazon-cloudwatch-agent-1.300066.1-1.1 on GA media","description":"These are all security issues fixed in the amazon-cloudwatch-agent-1.300066.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-06T00:00:00Z","modified":"2026-05-07T08:47:40.868463Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10744-1","title":"alloy-1.16.1-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.16.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T08:45:26.579022Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20816-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262955).\n- CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow\n  (bsc#1263530).\n\nChanges for alloy:\n\n- Update to version 1.16.1\n * Bug Fixes\n logging: Fix startup deadlock when components log before\n logging config is evaluated\n Update to Beyla 3.9.8\n Migrate from Docker to Moby\n","status":"published","published":"2026-05-27T09:08:57Z","modified":"2026-05-29T18:24:11.567436663Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20940-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n\n- Update to version 11.6.14+security-04:\n  Security:\n  * CVE-2026-28374: Fix insecure direct object reference in\n    Annotations API (bsc#1265290)\n  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live\n    push endpoint (bsc#1265289)\n  * CVE-2026-28383: Fix unbounded memory allocation in Grafana\n    plugin resources (bsc#1265286)\n  * CVE-2026-28380: Fix broken access control in Snapshot API\n    (bsc#1265287)\n  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass\n    (bsc#1265285)\n  * CVE-2026-28379: Fix viewer-triggered race condition in\n    Grafana Live (bsc#1265288)\n  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation\n    (bsc#1265284)\n  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin\n    (bsc#1265283)\n  * CVE-2026-33381: Prevent users from generating Service Account\n    tokens after permissions removal (bsc#1265281)\n  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing\n    an authenticated attacker to read arbitrary files from the\n    Grafana server’s filesystem (bsc#1265282)\n\n- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)\n- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability\n  in Apache Thrift (bsc#1263501)\n\n- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1\n  (bsc#1258595)\n- CVE-2026-21725: Fix missing UID when deleting datasource by name\n  (bsc#1258873)\n\n- Update to version 11.6.14+security-01:\n  Security:\n  * CVE-2026-33375: Fix denial of Service via out-of-memory\n    exhaustion in MSSQL data source plugin (bsc#1260881)\n\n- Update to version 11.6.14:\n  Security:\n  * CVE-2026-27876: Fix remote arbitrary code execution via chained\n    SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fix information disclosure of data-source\n    passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fix denial of service via testdata data-source\n    (bsc#1261029)\n  * CVE-2026-27879: Fix denial of service via resample query\n    (bsc#1261027)\n  * CVE-2026-33186: Fix authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fix authorization bypass allows modification of\n    protected webhook URLs (bsc#1260878)\n\n- Update to version 11.6.13:\n  Enhancement:\n  * Wire the public dashboard service to the HTTP server\n\n- Update to version 11.6.12:\n  Enhancement:\n  * Update authentication redirect logic\n  Bug fix:\n  * Fix single panel render with variable references\n","status":"published","published":"2026-06-10T12:02:03Z","modified":"2026-06-13T18:24:19.477495413Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:21852-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262955).\n- CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow\n  (bsc#1263530).\n\nChanges for alloy:\n\n- Update to version 1.16.1\n * Bug Fixes\n logging: Fix startup deadlock when components log before\n logging config is evaluated\n Update to Beyla 3.9.8\n Migrate from Docker to Moby\n","status":"published","published":"2026-05-27T09:07:05Z","modified":"2026-06-02T18:24:30.993803231Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2243-1","title":"Security update 5.0.8 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Security Fixes:\n\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)\n\ngolang-github-prometheus-node_exporter:\n\n- Backward Compatibility and packaging changes:\n  - Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains\n  - Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility\n\n- Version 1.10.2:\n  - Fixed typo in Zswap metric name (meminfo)\n\n- Version 1.10.1:\n  - Fixed mount points being collected multiple times (filesystem)\n  - Refactored mountinfo parsing (bsc#1261810)\n  - Added Zswap/Zswapped metrics (meminfo)\n\n- Version 1.10.0:\n  - New collectors: PCIe devices, swaps\n  - Added systemd virtualization metrics, AIX metrics\n  - WiFi packet metrics, additional PCIe and TLB metrics\n  - Changed mdadm to use sysfs, added erofs to excluded filesystems\n  - Fixed bugs: cpufreq collector, ethtool metrics\n\ngolang-github-prometheus-prometheus:\n    \n- Security issues fixed:\n\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret\n    being exposed in plaintext via /-/config endpoint (bsc#1263986)\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests\n    whose declared decoded length exceeds the decode limit\n    (bsc#1263987).\n  - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label\n    values in old UI heatmap chart tick labels (bsc#1262222)\n  - CVE-2026-33186: Fixed authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    * Bump google.golang.org/grpc to version 1.79.3\n  - CVE-2026-27606: Fixed arbitrary file write via path traversal in\n    rollup (bsc#1258893)\n    * Bump rollup to version 4.59.0\n\n- Other changes:\n\n  - Remote-Write: Reject snappy-compressed requests whose\n    declared decoded length exceeds the decode limit.\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)  \n\n\nprometheus-postgres_exporter:\n\n- Security Fixes:\n\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode\n    limit (bsc#1263987)\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint\n    (bsc#1263986)\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)\n\n- Highlights of other changes and bug fixes:\n\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy\n\ngrafana was updated from version 11.6.11 to 11.6.14+security01:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\nspacecmd:\n\n- Version 5.0.16-0:\n\n  - Update translation strings\n\nuyuni-tools:\n\n- Version 0.1.39-0:\n\n  - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)\n  - Fixed default value for helm registry (bsc#1258927).\n  - Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  - Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  - Show where final tarball was generated (bsc#1259208)\n\n","status":"published","published":"2026-06-03T14:10:38Z","modified":"2026-06-04T09:00:07.843013639Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2258-1","title":"Security update for grafana","description":"This update for grafana to version to 11.6.14+security01 fixes the following issues:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\n  ","status":"published","published":"2026-06-03T14:22:06Z","modified":"2026-06-04T09:00:04.530372201Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2438-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server\n  to crash a client application via a DataRow message (bsc#1259919).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258099).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n  and lead to undefined behavior (bsc#1258609).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260317).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262955).\n- CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow\n  (bsc#1263530).\n\nNon security issue:\n\n- Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).\n- Update to version 1.16.1\n * Bug Fixes\n logging: Fix startup deadlock when components log before\n logging config is evaluated\n Update to Beyla 3.9.8\n Migrate from Docker to Moby\n- Use latest openSUSE Tumbleweed image for building web UI assets\n- Install nvm to set node version specified upstream\n- update to 1.16.0:\n * Features\n - Add clustering for loki.source.kubernetes_events (#6027)\n (3dbf587) (@petewall)\n - Add otelcol.auth.google client auth provider (#5526)\n (da99a66) (@dashpole, @clayton-cornell)\n - beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)\n - database_observability: Add support for GCP Cloud SQL\n metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)\n - database_observability: Make targets optional (#5924)\n (54664b2) (@matthewnolf)\n - database_observability: Update default excluded schemas and\n users (#6080) (b386fff) (@cristiangreco)\n - faro.receiver: Add sourcemap fetching from remote locations\n (#4614) (b6cb5da) (@Oxel40)\n - helm: Add support for global.image.pullPolicy (#6069)\n (2e2ce72) (@petewall)\n - helm: Allow configuring image pull policy for config reloader\n (#5923) (991539b) (@kalleep)\n - loki.secretfilter: Add label_timed_out option to mark\n timed-out log lines (#5898) (2ad8834) (@kleimkuhler)\n - loki.secretfilter: Add secrets_redacted_by_category_total\n metric combining rule and origin (#5855) (053a2f7)\n (@kleimkuhler)\n - loki.secretfilter: Change secretfilter to use go-re2 regex\n library instead of stdlib (#5909) (c16a660) (@mikefat)\n - loki.secretfilter: Remove redundant\n secrets_redacted_by_rule_total and secrets_redacted_by_origin\n metrics (#5970) (b16decb) (@kleimkuhler)\n - Oracle exporter can scrape more than one DB (#6008) (6fbad38)\n (@ptodev)\n - prometheus.exporter.cloudwatch: Upgrade YACE and drop\n aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)\n - prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0\n (#5836) (4f49b57) (@cristiangreco)\n - prometheus.remote_write: Sync WAL with upstream Prometheus\n (#5907) (e74a91b) (@x1unix)\n - pyroscope: Add support for extra async-profiler CLI arguments\n (#5472) (9251e33) (@ivanape)\n - pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope\n Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)\n - pyroscope: Update debuginfo client for HTTP/1.1 upload API\n (#6037) (879d8e5) (@korniltsev-grafanista)\n - Change service stop command from 'sc' to 'net' (#5906)\n (450973d) (@mateuszdrab)\n - database_observability.mysql: Refactor explain plan loop\n batch size (#5894) (f0fcd6b) (@cristiangreco)\n - database_observability.postgres: Cleanup embedded exporter\n collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)\n - database_observability.postgres: Fix EXPLAIN param count when\n placeholders repeat (#6082) (b612b81) (@rgeyer)\n - database_observability: Drop schema_detection from logs\n (#6076) (b0105cb) (@cristiangreco)\n - database_observability: Ensure connection_info_monitor\n goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco)\n - deps: Update module github.com/aws/aws-sdk-go-v2/service/s3\n to v1.97.3 [SECURITY] (#6004) (38f4346)\n - deps: Update module github.com/go-git/go-git/v5 to v5.17.1\n [SECURITY] (#5934) (a5154af)\n - deps: Update module github.com/go-git/go-git/v5 to v5.18.0\n [SECURITY] (#6090) (0e59d64)\n - deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0\n [SECURITY] (b44d51a) (@jharvey10)\n - deps: Update module\n go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp\n to v1.43.0 [SECURITY] (#6016) (d92c5c0)\n go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\n to v1.43.0 [SECURITY] (#6017) (e655bbc)\n - deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0\n [SECURITY] (#6018) (94006e8)\n - deps: Update some minor go dep versions (#5896) (4ddd0ed)\n (@jharvey10)\n - go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8)\n (@x1unix)\n - go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix,\n @kalleep)\n - Helm: RBAC template handles empty rule arrays (#4860)\n (c9430e9) (@naptalie, @dehaansa, @kalleep)\n - loki.process: Eliminate per-stream goroutines in multiline\n stage (#6036) (c089e2e) (@kgeckhart)\n - loki.process: Prevent stage.structured_metadata from adding\n the same metadata several times (#5965) (0ec8a26) (@kalleep,\n @thampiotr)\n - loki.process: Wrap template in a custom type and move\n validation to syntax.Validator (#5910) (700dd7d) (@kalleep)\n - prometheus.exporter.postgres: Close DB connections on update\n (#6021) (8da97cf) (@kalleep)\n - prometheus.scrape: Update scrape_native_histograms to be\n updated at runtime (#6087) (18b205c) (@kalleep)\n - pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache\n (#5911) (03ca563) (@luweglarz)\n - pyroscope.ebpf: Move Pyroscope ebpf metrics registration\n after component error handling (#5540) (a3c57c0) (@crbednarz,\n @marcsanmi)\n - pyroscope: Set user agent on debuginfo connect-go client\n (#6022) (38ad1ef) (@korniltsev-grafanista)\n - ui: Large arguments are downloaded as files instead of\n rendered (#5268) (26c67b3) (@ptodev)\n - Update go-m1cpu v0.1.7 -\u003e v0.2.1 to fix M5 chip crash (#6034)\n (7fa0cbc) (@ymotongpoo)\n - windows-installer: Increase service restart on failure delays\n (#5969) (add15b1) (@rknightion)\n- add script to package webassets inside a podman container, to not\n endanger or pollute the host system with npm\n- update to 1.15.1:\n goroutine exits on Stop\n * CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955)\n- update to 1.15.0:\n * BREAKING CHANGES\n - otelcol: Upgrade to OTel Collector v0.147.0\n - Renamed undocumented metrics that was previously prefixed\n with \u003ccomponent_id\u003e\u003cmetric_name\u003e to\n loki_source_awsfirehose\u003cmetric_name\u003e\n * Security\n CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1\n (bsc#1258609).\n - alloy-mixin: Add filters, groupBy, and multi-select dashboard\n variables\n - beyla.ebpf: Add support for Prometheus native histograms\n - beyla.ebpf: Bump Beyla to v3.6\n - converters: Support converting Promtail limits_config\n - database_observability.mysql: Add filtering of query samples\n and wait events by minimum duration\n - database_observability.mysql: Embed prometheus exporter\n within db-o11y component\n - database_observability.postgres: Add configurable limit to\n pg_stat_statements query\n - database_observability.postgres: Embed prometheus exporter\n - database_observability: Promote components to stable\n - Expose Functionality to Handle syslogs with Empty MSG Field\n - loki.process: Support structured metadata as source type of\n stage.labels for loki.process\n - loki.secretfilter: Add sampling for secretfilter entries\n - loki.source.gcplog: Add alloy config for MaxOutstandingBytes\n and MaxOutstandingMessages\n - loki.write: Add loki pipeline latency metric\n - mixin: Update loki dashboard\n - otelcol.receiver.datadog: Expose intake proxy and\n trace_id_cache_size settings\n - prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default\n - pyroscope.ebpf: Add comm, pid labels and kernel frame options\n- update to 1.14.1:\n - Correctly handle the deprecated topic field in\n otelcol.receiver.kafka configuration\n - loki.process: Protect against json that does not look like\n docker json format\n - loki.source.file: Keep positions for compressed files when\n reading is finished\n - prometheus.scrape: Update arguments and targets even if\n scrape_native_histograms and extra_metrics are updated\n- update to 1.14.0:\n - loki.secretfilter: Some config options are removed entirely:\n partial_mask (replaced with redact_percent), allowlist (now\n controlled with custom gitleaks config), enable_entropy,\n include_generic, types (now controlled with custom gitleaks\n config).\n - otelcol.receiver.prometheus: otelcol.receiver.prometheus no\n longer sets start times of OTLP metrics.\n * Security:\n- update to 1.13.2:\n - Expose missing otelcol.processor.tail_sampling options\n - mixin: Add zipped dashboards as a release artifact\n - profiler: Backport Go 1.26 gopclntab textStart fix\n - prometheus.exporter.postgres: Update version of the exporter\n fork to fix pg_settings\n - pyroscope.ebpf: Backport dotnet nibble map fix\n- update to 1.13.1:\n - timeout before starting new ones\n- update to 1.13.0:\n - otelcol: Upgrade to OTel Collector v0.142.0\n - otelcol.receiver.kafka: The global topic attribute has been\n deleted; use the topics attributes inside the logs, metrics,\n and traces blocks instead.\n - otelcol.exporter \u003e sending_queue \u003e batch \u003e min_size changed\n from 8192 to 2000 and max_size changed from 0 to 3000\n - Add a virtual_node_peer_attributes and\n virtual_node_extra_label arguments to\n otelcol.connector.servicegraph\n - Add an otelcol.processor.metric_start_time component\n - Add job level period, length, and add_cloudwatch_timestamp\n options and labels_snake_case to CW exporter\n - Add missing configuration parameter\n deployment_name_from_replicaset to k8sattributes processor\n - Add parcas symbols upload to pyroscope.ebpf\n - Add sharding for loki.write\n - Add unexposed otel engine and extension to codebase and\n change build structure\n - beyla.ebpf: Add meta_cache_address to\n beyla.ebpf.attributes.kubernetes\n - beyla.ebpf: Upgrade Beyla to v2.8.5\n - Change the defaults for sending_queue \u003e batch block inside\n otelcol.exporter components\n - cluster: Support DNS discovery mode prefixes in\n --cluster.join-addresses flag\n - converter: Update promtail converter to use file_match block\n for loki.source.file\n - database_observability: Add health check collector for\n postgres component\n - database_observability: Expose exclude_schemas and\n exclude_databases settings\n - database_observability: Support Azure cloud provider config\n data\n - database_observability.mysql: Support excluding schemas in\n all collectors\n - database_observability.postgres: Support excluding DBs in all\n collectors\n","status":"published","published":"2026-06-17T14:45:01Z","modified":"2026-06-18T08:15:04.326830274Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2768-1","title":"Security update 5.1.4 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot updated to version 1.2.1:\n\n- Key Update Highlights (v1.2.1)\n  - Added wait check for minion start (default 10s), configurable using rd.saltboot.salt_start_timeout option\n    (bsc#1260870)\n  - Decouple salt key wait check to use separate configurable option rd.saltboot.salt_key_timeout, with default 60s\n  - Introduce rd.saltboot namespace for all options, mark old as deprecated\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Security issues fixed:\n  - CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter\n    (bsc#1248699)\n\ngolang-github-boynux-squid_exporter:\n\n- Non customer facing changes\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Non customer facing changes\n\ngolang-github-prometheus-alertmanager:\n\n- Non customer facing changes\n\ngolang-github-prometheus-node_exporter updated to version 1.10.2:\n    \n- Key Update Highlights (v1.10.0 to v1.10.2):\n  - New Collectors: Added new collectors for PCIe devices and swaps.\n  - New Metrics: Introduced metrics for Zswap/Zswapped, Systemd Virtualization, and WiFi packets (received/transmitted)\n  - Bug Fixes: Resolved a duplicate collection bug in filesystem mount points, fixed a Zswap metric typo, and patched a\n    logging race condition in systemd.\n  - Changes: Switched mdadm to use sysfs for RAID metrics, and added erofs to the default excluded filesystems list.\n  - Internal Refactoring: filesystem mountinfo parsing refactor (bsc#1261810)\n\ngolang-github-prometheus-prometheus updated to version 3.5.3:\n\n- Security issues fixed:\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint\n    (v3.5.3) (bsc#1263986)\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the limit\n    (v3.5.3) (bsc#1263987)\n  - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels\n    (v3.5.2) (bsc#1262222).\n  - CVE-2026-39821: Fixed validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0\n    (backported patch) (bsc#1266608)\n\n- Other changes:\n  - Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (v3.5.3)\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)\n  - Internal update with non customer facing changes (v3.5.1)\n\ngrafana updated to version 11.6.14+security-04:\n\n- Security issues fixed in v11.6.14+security-04:\n  - CVE-2026-28374: Fixed insecure direct object reference in Annotations API (bsc#1265290)\n  - CVE-2026-28376: Fixed unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)\n  - CVE-2026-28383: Fixed unbounded memory allocation in Grafana plugin resources (bsc#1265286)\n  - CVE-2026-28380: Fixed broken access control in Snapshot API (bsc#1265287)\n  - CVE-2026-33376: Fixed Auth Proxy IPv6 whitelist bypass (bsc#1265285)\n  - CVE-2026-28379: Fixed viewer-triggered race condition in Grafana Live (bsc#1265288)\n  - CVE-2026-33377: Fixed dashboard Editor Privilege Escalation (bsc#1265284)\n  - CVE-2026-33378: Fixed OOM exception in Grafana Data Source Plugin (bsc#1265283)\n  - CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)\n  - CVE-2026-33380: Fixed vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary\n    files from the Grafana server’s filesystem (bsc#1265282)\n- Security issues fixed through backported patches:\n  - CVE-2026-39821: Fixed validation bypass and privilege escalation by\n    updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n  - CVE-2026-34986: Fixed panic in JWE decryption (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: \n    Fixed multiple issues when parsing HTML files (bsc#1267153)\n\nmgr-push updated to version 5.2.4:\n\n- Internal updates with no customer facing changes across versions (v5.2.1-0 to v5.2.4-0)\n\nprometheus-blackbox_exporter:\n\n- Security issues fixed:\n  - CVE-2026-39821: Fixed validation bypass and privilege escalation by\n    updating golang.org/x/net to version 0.55.0 (bsc#1266556)\n\nprometheus-postgres_exporter:\n\n- Security issues fixed:\n  - CVE-2022-21698: Fixed prometheus/client_golang possible denial of service using InstrumentHandlerCounter\n    (bsc#1248699)\n\nrhnlib updated to version 5.2.5:\n\n- Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.5-0)\n\nspacecmd updated to version 5.2.8:\n\n- Key Update Highlights (v5.2.3-0):\n  - Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  - Add subcommand to check if reboot is needed after applying all available patches\n- Key Update Highlights (v5.2.1-0):\n  - Use JSON instead of pickle for spacecmd cache (bsc#1227579)\n  - Fixed methods in api namespace in spacecmd (bsc#1249532)\n- Other changes (v5.2.2-0 to 5.2.8-0):\n  - Translation strings updates\n  - Internal updates with non customer facing changes\n\nspacewalk-client-tools updated to version 5.2.6:\n\n- Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.6-0)\n\nsupportutils-plugin-salt:\n\n- Non customer facing changes\n\nsupportutils-plugin-susemanager-client updated to version 5.2.3:\n\n- Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.3-0)\n\nuyuni-tools updated to version 5.2.12:\n\n- Key Update Highlights (v5.2.11-0)\n  - Improved pod readiness checks (bsc#1266012)\n- Key Update Highlights (v5.2.10-0)\n  - Preserve hub replicas during upgrade (bsc#1262708)\n  - Added mgrctl 'ssh' and 'ssh remove_known_host' commands\n  - Fixed startup checks for main server container (bsc#1263157)\n  - Fixed service dependencies (bsc#1263823)\n  - Updated default tag to 5.1.3.1 (bsc#1262760)\n  - Fixed missing registry for db image (bsc#1259739)\n  - Internal SANs for db and reportdb are no longer required\n  - Generate the same certificate for server and reportdb\n  - Fixed Report DB CA certificate (bsc#1260806)\n  - Removed waitForTraefik function (bsc#1261902)\n- Key Update Highlights (v5.2.8-0)\n  - Generate service template only after secrets are created\n- Key Update Highlights (v5.2.7-0)\n  - Admin secrets no longer required on upgrades (bsc#1262409)\n- Key Update Highlights (v5.2.6-0):\n  - Use podman secrets for SSL on proxy\n  - Fixed database online backup\n  - mgrctl copy command now infers target name automatically\n  - Restored TFTP port to proxy (bsc#1260905)\n  - TFTP disabled by default on server\n  - Fixed incorrect package dependencies declaration (bsc#1229105)\n  - Prevent cobbler port from being exposed\n  - Bumped zerolog to 1.34\n  - Ignore spacewalk-service stop return code.\n  - Stop automatically unhealthy container\n  - Use container based server setup instead tools bundled one\n- Key Update Highlights (v5.2.5-0)\n  - Removed migrate command\n  - Removed hub register command\n  - Split TFTP server into separate container\n  - Removed Kubernetes install/upgrade from mgrpxy\n- Key Update Highlights (v5.2.1-0)\n  - Fixed --dbupgrade-tag parameter (bsc#1249400)\n  - Added --registry-host, --registry-user, --registry-password options\n  - Deprecated --registry option\n  - Added SUSE Linux Enterprise 15 SP7 support\n  - Migrated custom SSL CA certificates (bsc#1232641)\n- Other changes (v5.2.1-0 to v5.2.12-0):\n  - Translation strings updates\n  - Internal updates with version bump but without customer facing changes\n \nuyuni-common-libs updated to version 5.2.5:\n\n- Key Update Highlights (v5.2.5-0):\n  - Cleaned up the checksum module by removing legacy MD5/SHA1 fallback imports in favor of using\n    standard hashlib directly\n- Other changes:\n  - Internal updates with non customer facing changes across versions (v5.2.1-0 to v5.2.5-0)\n\n","status":"published","published":"2026-07-06T07:48:36Z","modified":"2026-07-07T08:30:04.923782054Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2774-1","title":"Security update 5.1.4 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\nRelease Notes Highlights:\n    \n- Update to SUSE Multi-Linux Manager 5.1.4\n  * Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions\n  * Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0\n  * SUSE Liberty Linux 9.6 Support\n  * New API Endpoint - listMigrationTargetsWithChannels\n  * Debian 12 End-of-Life Notice\n  * SUSE Registry URL Change\n  * Security fixes:\n    CVE-2026-34986, CVE-2026-41602, CVE-2026-39821, CVE-2026-42198\n    CVE-2022-21698, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154\n    CVE-2026-28374, CVE-2026-28376, CVE-2026-28379, CVE-2026-28380\n    CVE-2026-28383, CVE-2026-33376, CVE-2026-33377, CVE-2026-33378\n    CVE-2026-33380, CVE-2026-33381\n  * Bugs mentioned:\n    bsc#1226578, bsc#1234567, bsc#1238890, bsc#1242916, bsc#1245107\n    bsc#1247707, bsc#1248699, bsc#1249243, bsc#1253032, bsc#1257583\n    bsc#1257894, bsc#1258041, bsc#1258079, bsc#1258144, bsc#1258382\n    bsc#1258816, bsc#1259087, bsc#1259230, bsc#1259261, bsc#1259474\n    bsc#1259479, bsc#1259482, bsc#1259521, bsc#1259590, bsc#1259591\n    bsc#1259700, bsc#1259739, bsc#1259787, bsc#1259960, bsc#1260031\n    bsc#1260614, bsc#1260806, bsc#1261305, bsc#1261307, bsc#1261327\n    bsc#1261631, bsc#1261723, bsc#1261753, bsc#1261841, bsc#1261902\n    bsc#1262090, bsc#1262285, bsc#1262460, bsc#1262471, bsc#1262492\n    bsc#1262595, bsc#1262708, bsc#1262720, bsc#1262761, bsc#1263814\n    bsc#1263841, bsc#1264149, bsc#1264234, bsc#1264256, bsc#1264966\n    bsc#1265134, bsc#1265319, bsc#1265358, bsc#1265975, bsc#1266012\n    bsc#1262950, bsc#1263501, bsc#1266600, bsc#1266556, bsc#1264174\n    bsc#1262222, bsc#1263986, bsc#1263987, bsc#1265290, bsc#1265289\n    bsc#1265288, bsc#1265287, bsc#1265286, bsc#1265285, bsc#1265284\n    bsc#1265283, bsc#1265282, bsc#1265281, bsc#1269253, bsc#1269534\n\nContainer images and uyuni-tools changes:\n\nserver-attestation-image:\n\n- Version 5.1.15\n  * Image rebuilt to the newest version with updated dependencies for\n    SUSE Multi-Linux Manager 5.1.4\n\nserver-hub-xmlrpc-api-image:\n\n- Version 5.1.14\n  * Image rebuilt to the newest version with updated dependencies for\n    SUSE Multi-Linux Manager 5.1.4\n\nserver-image:\n\n- Version 5.1.15\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added mozilla-nss-sysinit to Dockerfile required for FIPS\n    (bsc#1247707)\n  * Do not get repositories from SCC in the server container\n    (bsc#1242916)\n  * Added 'susemanager-tools', 'susemanager' and\n    'susemanager-tools-salt' packages to server-image\n\nserver-migration-14-16-image:\n\n- Version 5.1.14\n  * Image rebuilt to the newest version with updated dependencies\n     for SUSE Multi-Linux Manager 5.1.4\n\nserver-postgresql-image:\n\n- Version 5.1.13\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added needed pg_hba rules on upgrade (bsc#1262492, bsc#1264149)\n\nserver-saline-image:\n\n- Version 5.1.14\n  * Use python3*-tornado6 package to make it working with Python 3.11\n\nuyuni-tools:\n\n- Version 5.1.29-0\n  Check backup status only after database is started (bsc#1262492)\n- Version 5.1.28-0\n  * Remove waitForTraefik function (bsc#1261902)\n  * Fix inspect: missing registry for db image (bsc#1259739)\n  * Preserve hub replicas during upgrade (bsc#1262708)\n  * Stop automatically unhealthy container\n  * Ignore spacewalk-service stop return code.\n  * Use correct CA for Report DB (bsc#1260806)\n  * Do not call podman healthcheck run to wait for pods to be ready\n    (bsc#1266012)\n\n\nThe following packages are underlying build dependencies\nand system components used by the containers:\n\n\ncobbler:\n\n- Added the distro signature for rhel10 (bsc#1265134)\n\nliberate-formula:\n\n- Version 0.1.4\n  * No customer facing changes\n- Version 0.1.3\n  * Liberate formula support for EL10 (bsc#1265975)\n\nprometheus-exporters-formula:\n\n- Version 1.4.3\n  * Added support for Python 3.13\n  * Drop migrate_formula_data script as it is obsolete\n\nprometheus-postgres_exporter:\n\n- CVE-2022-21698: Replace github.com/prometheus/client_golang with\n  version 1.11.1 (bsc#1248699)\n\nsaline:\n\n- Update to version 2026.05.18:\n  * Explicitly set port number for Prometheus target\n  * Fixed the issue of using non-vendored tornado with Python 3.11\n\nsalt:\n\n- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n\nsaltboot-formula:\n\n- Update to version 1.1.0\n  * When autoselecting saltboot device, ignore cd/dvd (bsc#1259960)\n\nspacecmd:\n\n- Version 5.1.14-0\n  * Update translation strings\n\nspacewalk-backend:\n\n- Version 5.1.17-0\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Kickstart profile for RHEL 8 requires venv-salt-minion\n    instead of salt-minion (bsc#1259474)\n  * security(checksums): drop md5 and sha1 from checksum choices (bsc#1234567)\n  * Use PBKDF2-SHA256 (600000 iterations) for new\n    password hashes; verify legacy SHA-256 crypt(3)\n    hashes transparently\n\nspacewalk-java:\n\n- Version 5.1.28-0\n  * Check access rights on two formula API calls (bsc#1269253)\n  * Sanitize uploaded image name (bsc#1269534)\n- Version 5.1.26-0\n  * Added listMigrationTargetsWithChannels endpoint to return\n    the valid migration targets channels (jsc#SUMA-320)\n  * Fixed CSV export failure on system Details \u003e Custom Info page\n  * Added support for migration from SLES 15 to SLES 16\n  * Minor UI improvements and fixed spinning icon glitch\n    in Admin → Setup Wizard\n  * Updated the tab label for eligible subscription\n    systems (bsc#1249243)\n  * Fixed missing field labels in the Create User form.\n    (bsc#1259591)\n  * Enhance buttons readability and consistency across the product\n  * Fixed missing translations (bsc#1259787)\n  * Fixed hub SCC forwarding registration credential filter\n    (bsc#1260031)\n  * Sanitize inputs to avoid injection in rhn_conf\n    of http proxy settings inputs (bsc#1245107)\n  * Move Salt \u003e Remote Commands to its own RBAC namespace\n    (bsc#1261305)\n  * Make OIDC JWKS initialization startup-safe\n  * Sync package removal permissions in packages API with the Web UI\n    (bsc#1261327)\n  * Run ANALYZE asynchronously after CLM alignment to avoid\n    deadlocks (bsc#1261753)\n  * Fixed enforcement of consecutive chars in password policy\n    (bsc#1262761)\n  * Use salt's network module if host or nslookup are not installed\n    (bsc#1262720)\n  * Fixed Remote Commands hang on direct hostname (bsc#1226578)\n  * Fixed Python SyntaxWarning for invalid escape sequence '\\s' in\n    RHUI extract repo data script (bsc#1262595)\n  * Added 'unpushed' to AdvisoryStatus enum to handle EPEL errata\n    with unpushed status (bsc#1264234)\n  * Kickstart profile for RHEL 8 requires venv-salt-minion\n    instead of salt-minion (bsc#1259474)\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Remove validation of packages in kickstart profiles which are\n    not supported anymore (bsc#1259474)\n  * Numeric branch names should not be stored in double format\n    (bsc#1258382)\n  * Added missing pxeeventfailed notification message\n  * Do not add non-FQDN hostnames to the proxy fqdn list\n    (bsc#1263841)\n  * Use supscription matcher output for subscription expiration\n    warning (bsc#1257894)\n  * Fixed Oval data sync for ubuntu 26.04 (bsc#1265319)\n  * Recognize PBKDF2-SHA256 hashes alongside legacy\n    SHA-256 crypt(3) in the Java password check helpers\n  * security(saml2): default signature algorithm to rsa-sha256 (bsc#1234567)\n  * security(tls): remove TLSv1/TLSv1.1, allow TLSv1.3 for SMTP (bsc#1234567)\n  * Fixed CSRFTokenValidator FIPS compatibility by using\n    platform-default SecureRandom (bsc#1247707)\n  * Fixed conflicting cobbler system migrations\n\nspacewalk-web:\n\n- Version 5.1.21-0\n  * UI changes to support migration from SLES 15 to SLES 16\n  * Fixed issue causing a blank tab to appear in the\n    Image Building Details page (bsc#1253032)\n  * Minor UI improvements and fixed spinning icon glitch\n    in Admin → Setup Wizard\n  * Fixed an issue where the 'Create Token' modal could\n    become unresponsive when opened\n  * Fixed an issue causing all existing tokens to be\n    deleted in a loop\n  * Improved visibility of all parent rows in permissions table\n  * Enhance buttons placement for a more intuitive experience\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Align subscription matching page warning with dashboard\n    warning for expiring subscriptions (bsc#1257894)\n  * Added missing fragment import (bsc#1264966)\n\nsubscription-matcher:\n\n- Version 0.44\n  * Fixed 2 missing part numbers (bsc#1264256)\n\nsusemanager:\n\n- Version 5.1.17-0\n  * Added SUSE LibertyLinux 9.6 x86_64 bootstrap repository definition\n  * Removed spacewalk-diskcheck enablement\n  * Use correct CA for Report DB (bsc#1260806)\n  * Relicensed mgr-salt-ssh under Apache-2.0 and move it\n    to a separated package named susemanager-tools-salt\n\nsusemanager-build-keys:\n\n- Added Nvidia Cuda Tools key\n  Added: nvidia-cudatools-9CD0A493D42D0685.asc\n\nsusemanager-docs_en:\n\n- Updated the supported features table in the Client Configuration\n  Guide to include Red Hat Linux Enterprise 10 and clones\n- Added documentation on space usage percentage on the server and db\n  container which can be set using DISKCHECKALERT and DISKTHRESHOLD\n- Added Code 16 to Monitoring documentation (bsc#1263814)\n- Added documentation for deleting SCAP scan results to Administration\n  Guide (bsc#1262471)\n- Rephrased instructions for RBAC in Administration Guide (bsc#1258079)\n- Added troubleshooting section for BTRFS to Administration\n  Guide (bcs#1258816)\n- Removed mentions of Leap 15.5 and 15.4 and specified SUSE requiring\n  general or LTS support in Client Configuration Guide (bsc#1262285)\n- Added information about availability of SLE 16 and SL Micro 6.2\n  support in the product versions 5.1.2 and later (bsc#1260614)\n- Removed mention of CIS profile (bsc#1262460)\n- Corrected path for Salt minion in Retail Guide (#1262090)\n- Added explanation for translating mgradm arguments to YAML in\n  Installation and Upgrade Guide (bsc#1258144)\n- Removed Google Cloud Compute from PAYG documentation (bsc#1261631)\n- Added link to proxy creation from client to an existing document in\n  Installation and Upgrade Guide\n- Updated features table for EL 10 based distributions\n- Document Debian 13\n- Added support for Open Enterprise Server 25.4\n- Clarified how to get PTF images in air-gapped setup in Installation\n  and Upgrade Guide (bsc#1261307)\n- SUSE Multi-Linux Support does not support autoinstallation\n  (bsc#1259261)\n- Added instructions about accessing git repositories when building\n  images to Administration Guide\n- Added online database backup instructions to Administration Guide\n- Fixed comamnd for product deployment in Installation and Upgrade\n  Guide (bsc#1259479)\n- Added online database backup instructions\n\nsusemanager-schema:\n\n- Version 5.1.19-0\n  * Added the RBAC mapping for listMigrationTargetsWithChannels\n    end point (jsc#SUMA-320)\n  * Added index on rhnPackage (checksum_id) (bsc#1258041)\n  * Move Salt \u003e Remote Commands to its own RBAC namespace\n    (bsc#1261305)\n  * Sync package removal permissions in packages API with the Web UI\n    (bsc#1261327)\n  * Added 'unpushed' to rhn_errata_adv_status_ck constraint to\n    allow importing EPEL errata with unpushed status (bsc#1264234)\n  * Healthcheck on disk usage based on taskomatic (bsc#1238890)\n  * Added missing indexes for channels and tokens (bsc#1259590)\n  * Increase source_url on table rhncontentsource (bsc#1259230)\n\nsusemanager-sls:\n\n- Version 5.1.25-0\n  * Added salt states to support migration from SLES 15 to SLES 16\n  * Ignore podman interfaces when resolving FQDNs (bsc#1262720)\n  * Fixed GPG key import on first key deploy (bsc#1259482)\n  * Use either ansible-core or ansible packages\n    for Ansible Control node, prefer ansible-core (bsc#1259087)\n  * Fixed CPU reporting for ppc64le clients (bsc#1259521)\n  * Fixed refresh of virtual instance information (bsc#1261723)\n\nsusemanager-sync-data:\n\n- Version 5.1.10-0\n  * Added missing RES-EMS channel family (bsc#1265358)\n- Version 5.1.9-0\n  * Added SUSE Liberty Linux 9.6 x86_64 product entries\n\nuyuni-common-libs:\n\n- Version 5.1.6-0\n  * security(checksums): drop md5 and sha1 from checksum choices (bsc#1234567)\n  * Replaced deprecated inspect.getargspec with EAFP usedforsecurity detection\n\nuyuni-reportdb-schema:\n\n- version 5.1.7-0\n  * Increased url on table repository (bsc#1259230)\n\nuyuni-setup-reportdb:\n\n- Version 5.1.5-0\n  * Fixed delete of a reportdb user with uyuni-setup-reportdb-user\n    (bsc#1261841)\n\n\nvirtual-host-gatherer:\n\n- Version 1.0.31-0\n  * Dropped SUSECloud module as not longer maintainednor used\n- Version 1.0.30-0\n  * No customer facing changes\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Multi-Linux Manager Server.\n2. Upgrade mgradm and mgrctl.\n3. If you are in a disconnected environment, upgrade the image packages.\n4. Reboot the system.\n5. Run `mgradm upgrade podman` which will use the default image tags.\n","status":"published","published":"2026-07-06T07:52:25Z","modified":"2026-07-07T08:30:06.278184108Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3056-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241728).\n- CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).\n- CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents\n  (bsc#1251365).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type\n  in response to a key listing or signing request (bsc#1253508 bsc#1253517).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1253980 bsc#1253983).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253797 bsc#1253799).\n- CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by\n  `html.ParseFragment` (bsc#1251559).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267058).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx`\n  files can lead to the consumption of corrupted files (bsc#1258096).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path` \n  pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112\n  bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an\n  out-of-bounds read and potential information disclosure (bsc#1263313).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service\n  via stack exhaustion (bsc#1263247).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n","status":"published","published":"2026-07-15T13:28:46Z","modified":"2026-07-16T10:00:15.0086061Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3057-1","title":"Security update for terraform-provider-susepubliccloud","description":"This update for terraform-provider-susepubliccloud fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path`\n  pseudo-header (bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds\n  read and potential information disclosure (bsc#1263316).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via\n  stack exhaustion (bsc#1263247).\n","status":"published","published":"2026-07-15T13:30:06Z","modified":"2026-07-16T10:00:14.969281344Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}