{"id":"CVE-2026-41603","aliases":["ALPINE-CVE-2026-41603","BIT-thrift-2026-41603","DEBIAN-CVE-2026-41603","EUVD-2026-26021","GHSA-gf47-qgg5-9g9q","SUSE-SU-2026:3056-1","SUSE-SU-2026:3057-1","UBUNTU-CVE-2026-41603"],"status":"rejected","title":"Apache Thrift has an issue with Java TSSLTransportFactory hostname verification","description":"This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-297","CWE-306"],"published":"2026-04-28T09:19:40Z","modified":"2026-11-03T06:32:55Z","fixes":[{"ecosystem":"Maven","package":"org.apache.thrift:libthrift","fixed_in":["0.23.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"thrift","fixed_in":["0.23.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"thrift","fixed_in":["0.23.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.thrift:libthrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"thrift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.thrift:libthrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.13.0","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.18.0","0.18.1","0.19.0","0.20.0","0.21.0","0.22.0","0.6.1","0.7.0","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.3-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.14.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.14.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1"]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41603","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","tags":["web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/28/7","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14885","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41603","tags":["web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463411","tags":["web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41603.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["web","advisory"]},{"url":"https://github.com/apache/thrift/commit/0919c3d5506151514e283a63e1fe1ce83e2449d8","tags":["web"]},{"url":"https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66","tags":["web"]},{"url":"https://github.com/apache/thrift/releases/tag/v0.23.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gf47-qgg5-9g9q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41603","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41603.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41603","tags":["advisory"]},{"url":"https://github.com/apache/thrift","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208300","tags":["report"]},{"url":"https://bugzilla.suse.com/1241030","tags":["report"]},{"url":"https://bugzilla.suse.com/1241033","tags":["report"]},{"url":"https://bugzilla.suse.com/1241728","tags":["report"]},{"url":"https://bugzilla.suse.com/1251365","tags":["report"]},{"url":"https://bugzilla.suse.com/1251559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253508","tags":["report"]},{"url":"https://bugzilla.suse.com/1253517","tags":["report"]},{"url":"https://bugzilla.suse.com/1253797","tags":["report"]},{"url":"https://bugzilla.suse.com/1253799","tags":["report"]},{"url":"https://bugzilla.suse.com/1253980","tags":["report"]},{"url":"https://bugzilla.suse.com/1253983","tags":["report"]},{"url":"https://bugzilla.suse.com/1258096","tags":["report"]},{"url":"https://bugzilla.suse.com/1260139","tags":["report"]},{"url":"https://bugzilla.suse.com/1260149","tags":["report"]},{"url":"https://bugzilla.suse.com/1260180","tags":["report"]},{"url":"https://bugzilla.suse.com/1263247","tags":["report"]},{"url":"https://bugzilla.suse.com/1263313","tags":["report"]},{"url":"https://bugzilla.suse.com/1263357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263411","tags":["report"]},{"url":"https://bugzilla.suse.com/1263445","tags":["report"]},{"url":"https://bugzilla.suse.com/1263515","tags":["report"]},{"url":"https://bugzilla.suse.com/1263606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264862","tags":["report"]},{"url":"https://bugzilla.suse.com/1264888","tags":["report"]},{"url":"https://bugzilla.suse.com/1264938","tags":["report"]},{"url":"https://bugzilla.suse.com/1266051","tags":["report"]},{"url":"https://bugzilla.suse.com/1266057","tags":["report"]},{"url":"https://bugzilla.suse.com/1266086","tags":["report"]},{"url":"https://bugzilla.suse.com/1266112","tags":["report"]},{"url":"https://bugzilla.suse.com/1266122","tags":["report"]},{"url":"https://bugzilla.suse.com/1266127","tags":["report"]},{"url":"https://bugzilla.suse.com/1266132","tags":["report"]},{"url":"https://bugzilla.suse.com/1266150","tags":["report"]},{"url":"https://bugzilla.suse.com/1266160","tags":["report"]},{"url":"https://bugzilla.suse.com/1266477","tags":["report"]},{"url":"https://bugzilla.suse.com/1266482","tags":["report"]},{"url":"https://bugzilla.suse.com/1266541","tags":["report"]},{"url":"https://bugzilla.suse.com/1266547","tags":["report"]},{"url":"https://bugzilla.suse.com/1267058","tags":["report"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263057-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41603","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41603","description":"This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.","status":"rejected","published":"2026-04-28T09:19:40.564Z","modified":"2026-07-27T14:16:46.731Z","updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-26021","description":"This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.","status":"published","published":"2026-04-28T09:19:40Z","modified":"2026-07-27T14:16:46Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:37.322622Z"}],"ghsa":[{"id":"GHSA-gf47-qgg5-9g9q","title":"Apache Thrift has an issue with Java TSSLTransportFactory hostname verification","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T12:31:30Z","modified":"2026-10-28T19:51:11Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295","CWE-297"],"updated_at":"2026-11-02T14:41:39.926569Z"}],"nvd":[{"id":"CVE-2026-41603","description":"Rejected reason: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.","status":"rejected","published":"2026-04-28T10:16:03.113Z","modified":"2026-07-27T15:16:49.447Z","updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-41603","title":"Apache Thrift: Java TSSLTransportFactory hostname verification","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:19:40.564Z","modified":"2026-10-28T20:26:38.877689816Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-297","CWE-306"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41603","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.  This issue affects Apache Thrift: before 0.23.0.  Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"withdrawn","published":"2026-04-28T10:16:03.113Z","modified":"2026-07-28T02:00:41.286304725Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-gf47-qgg5-9g9q","title":"Apache Thrift has an issue with Java TSSLTransportFactory hostname verification","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T12:31:30Z","modified":"2026-10-28T20:26:38.877689816Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295","CWE-297"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2026-41603","description":"Rejected reason: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.","status":"published","published":"2026-04-28T10:16:00Z","modified":"2026-07-29T10:18:11.959246024Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALPINE-CVE-2026-41603","description":"Rejected reason: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.","status":"published","published":"2026-04-28T10:16:03.113Z","modified":"2026-11-03T06:32:55.430645683Z","updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BIT-thrift-2026-41603","title":"Apache Thrift: Java TSSLTransportFactory hostname verification","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-29T08:50:20.169Z","modified":"2026-10-28T20:26:38.877689816Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"SUSE-SU-2026:3056-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241728).\n- CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).\n- CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents\n  (bsc#1251365).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type\n  in response to a key listing or signing request (bsc#1253508 bsc#1253517).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1253980 bsc#1253983).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253797 bsc#1253799).\n- CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by\n  `html.ParseFragment` (bsc#1251559).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267058).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx`\n  files can lead to the consumption of corrupted files (bsc#1258096).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path` \n  pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112\n  bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an\n  out-of-bounds read and potential information disclosure (bsc#1263313).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service\n  via stack exhaustion (bsc#1263247).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n","status":"published","published":"2026-07-15T13:28:46Z","modified":"2026-07-16T10:00:15.0086061Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3057-1","title":"Security update for terraform-provider-susepubliccloud","description":"This update for terraform-provider-susepubliccloud fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path`\n  pseudo-header (bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds\n  read and potential information disclosure (bsc#1263316).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via\n  stack exhaustion (bsc#1263247).\n","status":"published","published":"2026-07-15T13:30:06Z","modified":"2026-07-16T10:00:14.969281344Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}