{"id":"CVE-2026-4427","aliases":["DEBIAN-CVE-2026-4427","EUVD-2026-13115","GHSA-x6gf-mpr2-68h6","RHSA-2026:22450","RHSA-2026:22714","RLSA-2026:22450","RLSA-2026:22714","SUSE-SU-2026:21793-1","SUSE-SU-2026:2438-1","UBUNTU-CVE-2026-4427","openSUSE-SU-2026:10669-1","openSUSE-SU-2026:10684-1","openSUSE-SU-2026:20752-1"],"status":"rejected","title":"Duplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode","description":"Duplicate of CVE-2026-32286","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2026-03-19T14:24:02Z","modified":"2026-10-20T10:06:17Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"alloy","fixed_in":["1.16.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"osbuild-composer-worker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:10","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el10_2.rocky.0.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:9","package":"osbuild-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:165.1-2.el9_8.rocky.0.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150700.15.20.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.7.23-1.1"}]}],"bundled":4}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4427","tags":["advisory"]},{"url":"https://github.com/golang/vulndb/issues/4518","tags":["web","article","report"]},{"url":"https://github.com/jackc/pgx/issues/2507","tags":["web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4427","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448626","tags":["web","report"]},{"url":"https://github.com/jackc/pgproto3","tags":["package","report"]},{"url":"https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-x6gf-mpr2-68h6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4427","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22450","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-179244","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-180005","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22450.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","tags":["advisory"]},{"url":"https://go.dev/cl/736712","tags":["article"]},{"url":"https://go.dev/issue/77101","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4341","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61728","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","tags":["advisory"]},{"url":"https://go.dev/cl/736713","tags":["article"]},{"url":"https://go.dev/issue/77102","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4342","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://go.dev/cl/737700","tags":["article"]},{"url":"https://go.dev/issue/77217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4337","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4427","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27137","tags":["advisory"]},{"url":"https://go.dev/cl/752182","tags":["article"]},{"url":"https://go.dev/issue/77952","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4599","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","tags":["advisory"]},{"url":"https://go.dev/cl/763767","tags":["article"]},{"url":"https://go.dev/issue/78334","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4870","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32286","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4518","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33186","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22714","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-179251","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-180018","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22714.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22450","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22714","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621793-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258099","tags":["report"]},{"url":"https://bugzilla.suse.com/1258609","tags":["report"]},{"url":"https://bugzilla.suse.com/1259919","tags":["report"]},{"url":"https://bugzilla.suse.com/1260317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4427","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262438-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262955","tags":["report"]},{"url":"https://bugzilla.suse.com/1263530","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-4427","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34165","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-4427","description":"Duplicate of CVE-2026-32286","status":"rejected","published":"2026-03-19T14:24:02.864Z","modified":"2026-03-30T07:59:41.848Z","updated_at":"2026-11-02T14:19:59.369956Z"}],"euvd":[{"id":"EUVD-2026-13115","description":"Duplicate of CVE-2026-32286","status":"published","published":"2026-03-19T14:24:02Z","modified":"2026-03-30T07:59:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:26.783049Z"}],"ghsa":[{"id":"GHSA-x6gf-mpr2-68h6","title":"Duplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-jqcq-xjh3-6g23. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.","status":"withdrawn","published":"2026-03-19T15:31:22Z","modified":"2026-03-30T21:09:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:39:46.119458Z"}],"nvd":[{"id":"CVE-2026-4427","description":"Rejected reason: Duplicate of CVE-2026-32286","status":"rejected","published":"2026-03-19T15:16:28.71Z","modified":"2026-03-30T08:16:18.573Z","updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"DEBIAN-CVE-2026-4427","description":"A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.","status":"withdrawn","published":"2026-03-19T15:16:28.71Z","modified":"2026-03-30T19:01:21.638199Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-x6gf-mpr2-68h6","title":"Duplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-jqcq-xjh3-6g23. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.","status":"withdrawn","published":"2026-03-19T15:31:22Z","modified":"2026-09-10T03:51:00.794794961Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"RHSA-2026:22450","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-06-03T10:20:10Z","modified":"2026-10-20T10:06:15Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:22714","title":"Red Hat Security Advisory: osbuild-composer security update","status":"published","published":"2026-06-03T10:20:19Z","modified":"2026-10-20T10:06:17Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:22450","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-05T12:04:50.053452Z","modified":"2026-06-05T12:30:05.835476713Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:22714","title":"Important: osbuild-composer security update","description":"A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-11T12:03:24.031456Z","modified":"2026-06-11T12:30:12.868611552Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-4427","description":"A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.","status":"withdrawn","published":"2026-03-19T15:16:00Z","modified":"2026-04-02T21:23:22.42059Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"openSUSE-SU-2026:10669-1","title":"alloy-1.16.0-2.1 on GA media","description":"These are all security issues fixed in the alloy-1.16.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:46:12.956547Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10684-1","title":"teleport-17.7.23-1.1 on GA media","description":"These are all security issues fixed in the teleport-17.7.23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:47:02.792879Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20752-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server\n  to crash a client application via a DataRow message (bsc#1259919).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258099).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n  and lead to undefined behavior (bsc#1258609).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260317).\n\nNon security issue:\n\n- Updated to 1.16.0\n- Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)\n","status":"published","published":"2026-05-14T15:05:06Z","modified":"2026-05-19T18:23:46.736033799Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21793-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server\n  to crash a client application via a DataRow message (bsc#1259919).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258099).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n  and lead to undefined behavior (bsc#1258609).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260317).\n\nNon security issue:\n\n- Updated to 1.16.0\n- Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)\n","status":"published","published":"2026-05-14T15:04:53Z","modified":"2026-05-28T18:24:08.950186514Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2438-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server\n  to crash a client application via a DataRow message (bsc#1259919).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258099).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n  and lead to undefined behavior (bsc#1258609).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260317).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262955).\n- CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow\n  (bsc#1263530).\n\nNon security issue:\n\n- Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).\n- Update to version 1.16.1\n * Bug Fixes\n logging: Fix startup deadlock when components log before\n logging config is evaluated\n Update to Beyla 3.9.8\n Migrate from Docker to Moby\n- Use latest openSUSE Tumbleweed image for building web UI assets\n- Install nvm to set node version specified upstream\n- update to 1.16.0:\n * Features\n - Add clustering for loki.source.kubernetes_events (#6027)\n (3dbf587) (@petewall)\n - Add otelcol.auth.google client auth provider (#5526)\n (da99a66) (@dashpole, @clayton-cornell)\n - beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)\n - database_observability: Add support for GCP Cloud SQL\n metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)\n - database_observability: Make targets optional (#5924)\n (54664b2) (@matthewnolf)\n - database_observability: Update default excluded schemas and\n users (#6080) (b386fff) (@cristiangreco)\n - faro.receiver: Add sourcemap fetching from remote locations\n (#4614) (b6cb5da) (@Oxel40)\n - helm: Add support for global.image.pullPolicy (#6069)\n (2e2ce72) (@petewall)\n - helm: Allow configuring image pull policy for config reloader\n (#5923) (991539b) (@kalleep)\n - loki.secretfilter: Add label_timed_out option to mark\n timed-out log lines (#5898) (2ad8834) (@kleimkuhler)\n - loki.secretfilter: Add secrets_redacted_by_category_total\n metric combining rule and origin (#5855) (053a2f7)\n (@kleimkuhler)\n - loki.secretfilter: Change secretfilter to use go-re2 regex\n library instead of stdlib (#5909) (c16a660) (@mikefat)\n - loki.secretfilter: Remove redundant\n secrets_redacted_by_rule_total and secrets_redacted_by_origin\n metrics (#5970) (b16decb) (@kleimkuhler)\n - Oracle exporter can scrape more than one DB (#6008) (6fbad38)\n (@ptodev)\n - prometheus.exporter.cloudwatch: Upgrade YACE and drop\n aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)\n - prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0\n (#5836) (4f49b57) (@cristiangreco)\n - prometheus.remote_write: Sync WAL with upstream Prometheus\n (#5907) (e74a91b) (@x1unix)\n - pyroscope: Add support for extra async-profiler CLI arguments\n (#5472) (9251e33) (@ivanape)\n - pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope\n Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)\n - pyroscope: Update debuginfo client for HTTP/1.1 upload API\n (#6037) (879d8e5) (@korniltsev-grafanista)\n - Change service stop command from 'sc' to 'net' (#5906)\n (450973d) (@mateuszdrab)\n - database_observability.mysql: Refactor explain plan loop\n batch size (#5894) (f0fcd6b) (@cristiangreco)\n - database_observability.postgres: Cleanup embedded exporter\n collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)\n - database_observability.postgres: Fix EXPLAIN param count when\n placeholders repeat (#6082) (b612b81) (@rgeyer)\n - database_observability: Drop schema_detection from logs\n (#6076) (b0105cb) (@cristiangreco)\n - database_observability: Ensure connection_info_monitor\n goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco)\n - deps: Update module github.com/aws/aws-sdk-go-v2/service/s3\n to v1.97.3 [SECURITY] (#6004) (38f4346)\n - deps: Update module github.com/go-git/go-git/v5 to v5.17.1\n [SECURITY] (#5934) (a5154af)\n - deps: Update module github.com/go-git/go-git/v5 to v5.18.0\n [SECURITY] (#6090) (0e59d64)\n - deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0\n [SECURITY] (b44d51a) (@jharvey10)\n - deps: Update module\n go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp\n to v1.43.0 [SECURITY] (#6016) (d92c5c0)\n go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\n to v1.43.0 [SECURITY] (#6017) (e655bbc)\n - deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0\n [SECURITY] (#6018) (94006e8)\n - deps: Update some minor go dep versions (#5896) (4ddd0ed)\n (@jharvey10)\n - go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8)\n (@x1unix)\n - go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix,\n @kalleep)\n - Helm: RBAC template handles empty rule arrays (#4860)\n (c9430e9) (@naptalie, @dehaansa, @kalleep)\n - loki.process: Eliminate per-stream goroutines in multiline\n stage (#6036) (c089e2e) (@kgeckhart)\n - loki.process: Prevent stage.structured_metadata from adding\n the same metadata several times (#5965) (0ec8a26) (@kalleep,\n @thampiotr)\n - loki.process: Wrap template in a custom type and move\n validation to syntax.Validator (#5910) (700dd7d) (@kalleep)\n - prometheus.exporter.postgres: Close DB connections on update\n (#6021) (8da97cf) (@kalleep)\n - prometheus.scrape: Update scrape_native_histograms to be\n updated at runtime (#6087) (18b205c) (@kalleep)\n - pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache\n (#5911) (03ca563) (@luweglarz)\n - pyroscope.ebpf: Move Pyroscope ebpf metrics registration\n after component error handling (#5540) (a3c57c0) (@crbednarz,\n @marcsanmi)\n - pyroscope: Set user agent on debuginfo connect-go client\n (#6022) (38ad1ef) (@korniltsev-grafanista)\n - ui: Large arguments are downloaded as files instead of\n rendered (#5268) (26c67b3) (@ptodev)\n - Update go-m1cpu v0.1.7 -\u003e v0.2.1 to fix M5 chip crash (#6034)\n (7fa0cbc) (@ymotongpoo)\n - windows-installer: Increase service restart on failure delays\n (#5969) (add15b1) (@rknightion)\n- add script to package webassets inside a podman container, to not\n endanger or pollute the host system with npm\n- update to 1.15.1:\n goroutine exits on Stop\n * CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955)\n- update to 1.15.0:\n * BREAKING CHANGES\n - otelcol: Upgrade to OTel Collector v0.147.0\n - Renamed undocumented metrics that was previously prefixed\n with \u003ccomponent_id\u003e\u003cmetric_name\u003e to\n loki_source_awsfirehose\u003cmetric_name\u003e\n * Security\n CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1\n (bsc#1258609).\n - alloy-mixin: Add filters, groupBy, and multi-select dashboard\n variables\n - beyla.ebpf: Add support for Prometheus native histograms\n - beyla.ebpf: Bump Beyla to v3.6\n - converters: Support converting Promtail limits_config\n - database_observability.mysql: Add filtering of query samples\n and wait events by minimum duration\n - database_observability.mysql: Embed prometheus exporter\n within db-o11y component\n - database_observability.postgres: Add configurable limit to\n pg_stat_statements query\n - database_observability.postgres: Embed prometheus exporter\n - database_observability: Promote components to stable\n - Expose Functionality to Handle syslogs with Empty MSG Field\n - loki.process: Support structured metadata as source type of\n stage.labels for loki.process\n - loki.secretfilter: Add sampling for secretfilter entries\n - loki.source.gcplog: Add alloy config for MaxOutstandingBytes\n and MaxOutstandingMessages\n - loki.write: Add loki pipeline latency metric\n - mixin: Update loki dashboard\n - otelcol.receiver.datadog: Expose intake proxy and\n trace_id_cache_size settings\n - prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default\n - pyroscope.ebpf: Add comm, pid labels and kernel frame options\n- update to 1.14.1:\n - Correctly handle the deprecated topic field in\n otelcol.receiver.kafka configuration\n - loki.process: Protect against json that does not look like\n docker json format\n - loki.source.file: Keep positions for compressed files when\n reading is finished\n - prometheus.scrape: Update arguments and targets even if\n scrape_native_histograms and extra_metrics are updated\n- update to 1.14.0:\n - loki.secretfilter: Some config options are removed entirely:\n partial_mask (replaced with redact_percent), allowlist (now\n controlled with custom gitleaks config), enable_entropy,\n include_generic, types (now controlled with custom gitleaks\n config).\n - otelcol.receiver.prometheus: otelcol.receiver.prometheus no\n longer sets start times of OTLP metrics.\n * Security:\n- update to 1.13.2:\n - Expose missing otelcol.processor.tail_sampling options\n - mixin: Add zipped dashboards as a release artifact\n - profiler: Backport Go 1.26 gopclntab textStart fix\n - prometheus.exporter.postgres: Update version of the exporter\n fork to fix pg_settings\n - pyroscope.ebpf: Backport dotnet nibble map fix\n- update to 1.13.1:\n - timeout before starting new ones\n- update to 1.13.0:\n - otelcol: Upgrade to OTel Collector v0.142.0\n - otelcol.receiver.kafka: The global topic attribute has been\n deleted; use the topics attributes inside the logs, metrics,\n and traces blocks instead.\n - otelcol.exporter \u003e sending_queue \u003e batch \u003e min_size changed\n from 8192 to 2000 and max_size changed from 0 to 3000\n - Add a virtual_node_peer_attributes and\n virtual_node_extra_label arguments to\n otelcol.connector.servicegraph\n - Add an otelcol.processor.metric_start_time component\n - Add job level period, length, and add_cloudwatch_timestamp\n options and labels_snake_case to CW exporter\n - Add missing configuration parameter\n deployment_name_from_replicaset to k8sattributes processor\n - Add parcas symbols upload to pyroscope.ebpf\n - Add sharding for loki.write\n - Add unexposed otel engine and extension to codebase and\n change build structure\n - beyla.ebpf: Add meta_cache_address to\n beyla.ebpf.attributes.kubernetes\n - beyla.ebpf: Upgrade Beyla to v2.8.5\n - Change the defaults for sending_queue \u003e batch block inside\n otelcol.exporter components\n - cluster: Support DNS discovery mode prefixes in\n --cluster.join-addresses flag\n - converter: Update promtail converter to use file_match block\n for loki.source.file\n - database_observability: Add health check collector for\n postgres component\n - database_observability: Expose exclude_schemas and\n exclude_databases settings\n - database_observability: Support Azure cloud provider config\n data\n - database_observability.mysql: Support excluding schemas in\n all collectors\n - database_observability.postgres: Support excluding DBs in all\n collectors\n","status":"published","published":"2026-06-17T14:45:01Z","modified":"2026-06-18T08:15:04.326830274Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}