{"id":"CVE-2026-44740","aliases":["ALSA-2026:46391","DEBIAN-CVE-2026-44740","EUVD-2026-33663","GHSA-m3xc-h892-ggx6","GO-2026-5490","RHSA-2026:32963","RHSA-2026:32974","RHSA-2026:35111","RHSA-2026:46391","RHSA-2026:68334","RHSA-2026:68335","RLSA-2026:46391","ROOT-APP-GOBINARY-CVE-2026-44740","SUSE-SU-2026:22157-1","SUSE-SU-2026:22575-1","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","SUSE-SU-2026:2467-1","SUSE-SU-2026:2468-1","SUSE-SU-2026:2824-1","SUSE-SU-2026:3056-1","SUSE-SU-2026:4628-1","UBUNTU-CVE-2026-44740","openSUSE-SU-2026:10856-1","openSUSE-SU-2026:10941-1","openSUSE-SU-2026:10943-1","openSUSE-SU-2026:10967-1","openSUSE-SU-2026:10996-1","openSUSE-SU-2026:11053-1","openSUSE-SU-2026:20956-1","openSUSE-SU-2026:21072-1","openSUSE-SU-2026:21079-1","openSUSE-SU-2026:21251-1","openSUSE-SU-2026:21436-1","openSUSE-SU-2026:21551-1"],"status":"published","title":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00389,"percentile":0.33417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-835"],"published":"2026-05-13T15:29:47Z","modified":"2026-10-29T11:02:24Z","fixes":[{"ecosystem":"Go","package":"github.com/go-git/go-billy/v5","fixed_in":["5.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/go-git/go-billy/v6","fixed_in":["6.0.0-alpha.1"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"grafana","fixed_in":["9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"grafana-selinux","fixed_in":["9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-git-go-billy","fixed_in":["5.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-git-go-billy-v6","fixed_in":["6.0.0~alpha.1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","fixed_in":["0:9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","fixed_in":["0:9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debugsource","fixed_in":["0:9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-selinux","fixed_in":["0:9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"grafana","fixed_in":["0:9.2.10-32.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/go-git/go-billy/v5","fixed_in":["v5.6.0-root.io.1","v5.6.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/go-git/go-billy/v5","fixed_in":["v5.6.0-aikido.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","fixed_in":["3.3.4624.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-bug","fixed_in":["0.10.1-6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-git/go-billy/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-git/go-billy/v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-alpha.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.1-3","5.5.0-1","5.5.0-2","5.8.0-1","5.9.0-1","5.9.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.0-1","5.5.0-2","5.8.0-1","5.9.0-1","5.9.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0-1"}]}],"versions":["5.5.0-1","5.5.0-2","5.8.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-git-go-billy-v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0~alpha.1-1"}]}],"versions":["6~git20260226.45bd095-1","6~git20260226.45bd095-2"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-billy/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-billy/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0-alpha.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-billy/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.115.0-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"syft","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.46.0-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.72.0-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-32.el8_10"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/go-git/go-billy/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v5.6.0-root.io.1"},{"fixed":"v5.6.0-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/go-git/go-billy/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v5.6.0-aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-160000.1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-160000.1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-150000.5.37.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-150000.5.37.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-150000.5.37.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-150000.5.37.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-4.49.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-150700.15.23.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.1-2","5.3.1-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.0-2","5.8.0-1","5.9.0-1","5.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-git-go-billy-v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6~git20260226.45bd095-2","6.0.0~alpha.1-2","6.0.0~alpha.1-3","6.0.0~alpha.2-1","6.0.0~alpha.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-go-git-go-billy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.0-1","5.5.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.2-1.1"}]}],"bundled":23},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-1.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.0-160000.1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.71.2-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4624.0-160000.1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-bp160.1.1"}]}],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77}],"products":[{"vendor":"go-git","product":"go-billy"}],"references":[{"url":"https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/go-git/go-billy/releases/tag/v5.9.0","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44740","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m3xc-h892-ggx6"},{"url":"https://access.redhat.com/errata/RHSA-2026:46391","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44740","tags":["report"]},{"url":"https://bugzilla.redhat.com/2483894","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-46391.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44740.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44740","tags":["advisory"]},{"url":"https://github.com/go-git/go-billy","tags":["package"]},{"url":"https://github.com/go-git/go-billy/pull/203","tags":["fix"]},{"url":"https://access.redhat.com/errata/RHSA-2026:32963","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47262","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53492","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53489","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_32963.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483894","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44740","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47262","tags":["advisory"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53489","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53489","tags":["advisory"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53492","tags":["advisory"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:32974","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_32974.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35111","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46680","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53488","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50195","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32285","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41506","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48702","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35111.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32285","tags":["advisory"]},{"url":"https://github.com/buger/jsonparser/issues/275","tags":["article"]},{"url":"https://github.com/golang/vulndb/issues/4514","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4514","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41506","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/releases/tag/v5.18.0","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2","tags":["article"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46680","tags":["advisory"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48702","tags":["advisory"]},{"url":"https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50195","tags":["advisory"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53488","tags":["advisory"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-188279","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46391.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68334","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68334.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39831","tags":["advisory"]},{"url":"https://go.dev/cl/781662","tags":["article"]},{"url":"https://go.dev/issue/79566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5019","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41178","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/7880","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46597","tags":["advisory"]},{"url":"https://go.dev/cl/781620","tags":["article"]},{"url":"https://go.dev/issue/79561","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5013","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","tags":["advisory"]},{"url":"https://go.dev/cl/794100","tags":["article"]},{"url":"https://go.dev/issue/80142","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71556","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab","tags":["article"]},{"url":"https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","tags":["article"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81521","tags":["advisory"]},{"url":"https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68335","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68335.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:46391","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622157-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1238702","tags":["report"]},{"url":"https://bugzilla.suse.com/1239342","tags":["report"]},{"url":"https://bugzilla.suse.com/1253611","tags":["report"]},{"url":"https://bugzilla.suse.com/1258095","tags":["report"]},{"url":"https://bugzilla.suse.com/1264952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265474","tags":["report"]},{"url":"https://bugzilla.suse.com/1266200","tags":["report"]},{"url":"https://bugzilla.suse.com/1266781","tags":["report"]},{"url":"https://bugzilla.suse.com/1267332","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622575-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260981","tags":["report"]},{"url":"https://bugzilla.suse.com/1265440","tags":["report"]},{"url":"https://bugzilla.suse.com/1266196","tags":["report"]},{"url":"https://bugzilla.suse.com/1266654","tags":["report"]},{"url":"https://bugzilla.suse.com/1267185","tags":["report"]},{"url":"https://bugzilla.suse.com/1267333","tags":["report"]},{"url":"https://bugzilla.suse.com/1267481","tags":["report"]},{"url":"https://bugzilla.suse.com/1267485","tags":["report"]},{"url":"https://bugzilla.suse.com/1267488","tags":["report"]},{"url":"https://bugzilla.suse.com/1267489","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45686","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262467-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262468-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262824-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267811","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10722","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208300","tags":["report"]},{"url":"https://bugzilla.suse.com/1241030","tags":["report"]},{"url":"https://bugzilla.suse.com/1241033","tags":["report"]},{"url":"https://bugzilla.suse.com/1241728","tags":["report"]},{"url":"https://bugzilla.suse.com/1251365","tags":["report"]},{"url":"https://bugzilla.suse.com/1251559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253508","tags":["report"]},{"url":"https://bugzilla.suse.com/1253517","tags":["report"]},{"url":"https://bugzilla.suse.com/1253797","tags":["report"]},{"url":"https://bugzilla.suse.com/1253799","tags":["report"]},{"url":"https://bugzilla.suse.com/1253980","tags":["report"]},{"url":"https://bugzilla.suse.com/1253983","tags":["report"]},{"url":"https://bugzilla.suse.com/1258096","tags":["report"]},{"url":"https://bugzilla.suse.com/1260139","tags":["report"]},{"url":"https://bugzilla.suse.com/1260149","tags":["report"]},{"url":"https://bugzilla.suse.com/1260180","tags":["report"]},{"url":"https://bugzilla.suse.com/1263247","tags":["report"]},{"url":"https://bugzilla.suse.com/1263313","tags":["report"]},{"url":"https://bugzilla.suse.com/1263357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263411","tags":["report"]},{"url":"https://bugzilla.suse.com/1263445","tags":["report"]},{"url":"https://bugzilla.suse.com/1263515","tags":["report"]},{"url":"https://bugzilla.suse.com/1263606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264862","tags":["report"]},{"url":"https://bugzilla.suse.com/1264888","tags":["report"]},{"url":"https://bugzilla.suse.com/1264938","tags":["report"]},{"url":"https://bugzilla.suse.com/1266051","tags":["report"]},{"url":"https://bugzilla.suse.com/1266057","tags":["report"]},{"url":"https://bugzilla.suse.com/1266086","tags":["report"]},{"url":"https://bugzilla.suse.com/1266112","tags":["report"]},{"url":"https://bugzilla.suse.com/1266122","tags":["report"]},{"url":"https://bugzilla.suse.com/1266127","tags":["report"]},{"url":"https://bugzilla.suse.com/1266132","tags":["report"]},{"url":"https://bugzilla.suse.com/1266150","tags":["report"]},{"url":"https://bugzilla.suse.com/1266160","tags":["report"]},{"url":"https://bugzilla.suse.com/1266477","tags":["report"]},{"url":"https://bugzilla.suse.com/1266482","tags":["report"]},{"url":"https://bugzilla.suse.com/1266541","tags":["report"]},{"url":"https://bugzilla.suse.com/1266547","tags":["report"]},{"url":"https://bugzilla.suse.com/1267058","tags":["report"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41636","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276980","tags":["report"]},{"url":"https://bugzilla.suse.com/1276990","tags":["report"]},{"url":"https://bugzilla.suse.com/1278267","tags":["report"]},{"url":"https://bugzilla.suse.com/1278269","tags":["report"]},{"url":"https://bugzilla.suse.com/1278272","tags":["report"]},{"url":"https://bugzilla.suse.com/1278462","tags":["report"]},{"url":"https://bugzilla.suse.com/1278477","tags":["report"]},{"url":"https://bugzilla.suse.com/1278505","tags":["report"]},{"url":"https://bugzilla.suse.com/1278742","tags":["report"]},{"url":"https://bugzilla.suse.com/1278743","tags":["report"]},{"url":"https://bugzilla.suse.com/1278751","tags":["report"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279080","tags":["report"]},{"url":"https://bugzilla.suse.com/1279137","tags":["report"]},{"url":"https://bugzilla.suse.com/1279243","tags":["report"]},{"url":"https://bugzilla.suse.com/1279245","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://bugzilla.suse.com/1279263","tags":["report"]},{"url":"https://bugzilla.suse.com/1279386","tags":["report"]},{"url":"https://bugzilla.suse.com/1280175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-44740","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42500","tags":["web"]},{"url":"https://bugzilla.suse.com/1265648","tags":["report"]},{"url":"https://bugzilla.suse.com/1266075","tags":["report"]},{"url":"https://bugzilla.suse.com/1266495","tags":["report"]},{"url":"https://bugzilla.suse.com/1267047","tags":["report"]},{"url":"https://bugzilla.suse.com/1267268","tags":["report"]},{"url":"https://bugzilla.suse.com/1268356","tags":["report"]},{"url":"https://bugzilla.suse.com/1268399","tags":["report"]},{"url":"https://bugzilla.suse.com/1268400","tags":["report"]},{"url":"https://bugzilla.suse.com/1268403","tags":["report"]},{"url":"https://bugzilla.suse.com/1268404","tags":["report"]},{"url":"https://bugzilla.suse.com/1268440","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53492","tags":["web"]},{"url":"https://bugzilla.suse.com/1262438","tags":["report"]},{"url":"https://bugzilla.suse.com/1262439","tags":["report"]},{"url":"https://bugzilla.suse.com/1266210","tags":["report"]},{"url":"https://bugzilla.suse.com/1267192","tags":["report"]},{"url":"https://bugzilla.suse.com/1267869","tags":["report"]},{"url":"https://bugzilla.suse.com/1271056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59733","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-44740","title":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","status":"published","published":"2026-06-01T16:04:50.358Z","modified":"2026-06-01T18:14:04.315Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-674","CWE-835"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-33663","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","status":"published","published":"2026-06-01T16:04:50Z","modified":"2026-06-01T18:14:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"ghsa":[{"id":"GHSA-m3xc-h892-ggx6","title":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","description":"### Impact\nMultiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.\n\nThese issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-billy` version.\n\n### Credits\nThanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇","status":"published","published":"2026-05-13T15:29:47Z","modified":"2026-06-09T10:50:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674","CWE-835"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-44740","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","status":"published","published":"2026-06-01T17:17:08.277Z","modified":"2026-07-22T07:10:00.107Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-674","CWE-835"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-44740","title":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","status":"published","published":"2026-06-01T16:04:50.358Z","modified":"2026-10-28T02:30:52.469640504Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674","CWE-835"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44740","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","status":"published","published":"2026-06-01T17:17:08.277Z","modified":"2026-10-01T03:03:15.19953977Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-m3xc-h892-ggx6","title":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","description":"### Impact\nMultiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.\n\nThese issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-billy` version.\n\n### Credits\nThanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇","status":"published","published":"2026-05-13T15:29:47Z","modified":"2026-09-10T03:50:55.263613118Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674","CWE-835"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"RHSA-2026:32963","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-03T10:13:24Z","modified":"2026-10-20T10:07:19Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:32974","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-03T10:13:25Z","modified":"2026-10-20T10:07:20Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:35111","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-03T10:13:59Z","modified":"2026-10-20T10:07:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:46391","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2026-07-28T10:13:44Z","modified":"2026-10-20T10:09:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:68334","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","status":"published","published":"2026-09-17T10:18:18Z","modified":"2026-10-20T10:14:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68335","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","status":"published","published":"2026-09-17T10:18:18Z","modified":"2026-10-20T10:14:11Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:46391","title":"Important: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)\n\nBug Fix(es) and Enhancement(s):\n\n* [grafana / rhel-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188279)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T06:01:06.284655Z","modified":"2026-07-28T06:30:06.241984181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-44740","title":"CVE-2026-44740 in rootio-github.com/go-git/go-billy/v5 - Patched by Root","description":"Root has patched CVE-2026-44740 in the rootio-github.com/go-git/go-billy/v5 package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-06-25T11:13:46Z","modified":"2026-06-25T13:17:30.492336247Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-44740","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","status":"published","published":"2026-06-01T17:17:00Z","modified":"2026-10-17T12:58:20.623900517Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"ALSA-2026:46391","title":"Important: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [grafana / almalinux-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188279)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-10-29T11:02:24.649861697Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"GO-2026-5490","title":"Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy","description":"Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy","status":"published","published":"2026-07-24T18:35:55Z","modified":"2026-08-08T21:41:53.435927217Z","updated_at":"2026-11-02T15:47:02.556545Z"},{"id":"openSUSE-SU-2026:10856-1","title":"rclone-1.74.2-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.301746118Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10941-1","title":"trivy-0.71.0-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.71.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-02T00:00:00Z","modified":"2026-06-03T08:30:27.374747983Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10943-1","title":"amazon-ssm-agent-3.3.4624.0-1.1 on GA media","description":"These are all security issues fixed in the amazon-ssm-agent-3.3.4624.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-03T00:00:00Z","modified":"2026-06-04T09:00:05.941815082Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10967-1","title":"cheat-5.1.0-2.1 on GA media","description":"These are all security issues fixed in the cheat-5.1.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-08T00:00:00Z","modified":"2026-06-09T09:00:05.908133757Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10996-1","title":"git-bug-0.10.1-6.1 on GA media","description":"These are all security issues fixed in the git-bug-0.10.1-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-06-12T08:45:07.265762812Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11053-1","title":"alloy-1.17.0-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-18T00:00:00Z","modified":"2026-06-19T08:15:08.395285261Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20956-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues\n\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267047).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265648).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266495).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266075).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266075).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266075).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266075).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266075).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266075).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266075).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266075).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266075).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266075).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267268).\n\nChanges for trivy:\n\n- Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):\n * release: v0.71.0 [main] (#10638)\n * ci: use only the first line of commit message in release-please workflow (#10766)\n * feat: add WithDriver and WithProvider options to ospkg detector (#10740)\n * chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)\n * refactor(secret): normalize configPath once in Init (#10702)\n * feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml\n   files (#10704)\n * chore(deps): bump the common group across 1 directory with 25 updates (#10758)\n * chore: migrate from gomodguard to gomodguard_v2 (#10739)\n * chore(deps): bump the docker group across 1 directory with 2 updates (#10709)\n * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)\n * ci: scope GitHub App tokens to minimum required permissions (#10755)\n * chore(deps): upgrade go-redis from v8 to v9 (#10736)\n * fix(misconf): fix rendering of nested values in terraform plan lists (#10746)\n * fix(misconf): skip resources with no after changes (#10352)\n * fix(misconf): reject nil plays during playbook parsing (#10273)\n * fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)\n * fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)\n * refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)\n * chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)\n * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)\n * fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)\n * fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions (#10731)\n * chore(deps): upgrade github.com/cenkalti/backoff dependency to v5 (#10705)\n * chore: bump golangci-lint to v2.12 (#10726)\n * feat(spdx): add SHA-512 hash algorithm support to SPDX serializer (#10719)\n * feat(sbom): support for CycloneDX 1.7 (#10715)\n * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.300.0 to 1.302.0 in the aws group (#10708)\n * chore: migrate from helm.sh/helm/v3 to helm.sh/helm/v4 (#10678)\n * fix(image): correctly reconstruct RUN instructions built without BuildKit (#10714)\n * feat(java): support \u003cmirrors\u003e from settings.xml (#10692)\n * fix(java): surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files (#10693)\n * chore: bump go to 1.26.3 (#10683)\n * fix(nodejs): handle legacy license formats in npm lockfile parser (#10684)\n * fix(secret): correctly skip secret-scanner config file from scanning (#10666)\n * feat(ubuntu): detect Ubuntu 26.04 LTS (#10592)\n * refactor(nodejs): deduplicate license traversal across package managers (#10681)\n * fix: overwrite OS packages PURLs after overwrite OS (#10298)\n * feat(secret): add Azure secret detection rules (#10562)\n * fix(misconf): prevent path traversal in Terraform filesystem functions (#10664)\n * feat(secret): add a way to customize skipped folders, files and exts (#10550)\n * ci: migrate PAT tokens to GitHub App (#10628)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#10598)\n * chore(deps): bump the docker group across 1 directory with 3 updates (#10596)\n * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10608)\n * chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#10641)\n * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#10648)\n * ci: migrate PAT tokens to GITHUB_TOKEN for reusable-release workflow (#10655)\n * feat(seal): add vendor support for language file detection. (#10297)\n * fix(misconf): make identifiers in ignore rules case-insensitive (#10375)\n * fix: pull instead of clone when test repo already exists (#10636)\n * docs: document how to disable check.trivy.dev connections (#10623)\n * docs(misconf): fix typo in misconfiguration config (#10619)\n * ci: remove secrets from run block (#10590)\n * docs: fix typos (#10605)\n * refactor(deps): replace archived go-homedir with os.UserHomeDir (#10484)\n * chore(deps): Bump `go-ini` and fix the import path. (#10489)\n * chore(deps): bump the github-actions group across 2 directories with 9 updates (#10495)\n * chore(deps): bump github.com/aquasecurity/testdocker (#10543)\n * docs: convert README demonstration videos to mp4 (#10419)\n * chore(deps): upgrade vm scan dependency for bug fix (#10575)\n * docs(nodejs): clarify package.json behavior in image scanning (#10572)\n * chore(deps): replace xeipuuv/gojsonschema and invopop/jsonschema with google/jsonschema-go (#10528)\n * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (#10554)\n * chore(deps): bump alpine to 3.23.4 (#10552)\n * ci(helm): bump Trivy version to 0.70.0 for Trivy Helm Chart 0.22.0 (#10547)\n- update x/net to v0.55.0 (\n bsc#1266495, CVE-2026-39821\n bsc#1267047, CVE-2026-25680,\n CVE-2026-42502,\n CVE-2026-27136,\n CVE-2026-25681,\n CVE-2026-42506)\n- update x/crypto to 0.52.0 (bsc#1266075, CVE-2026-39827,\n CVE-2026-39834,CVE-2026-39828,CVE-2026-39829,CVE-2026-39831,\n CVE-2026-42508,CVE-2026-39833,CVE-2026-39830,CVE-2026-39832,\n CVE-2026-46597,CVE-2026-46598,CVE-2026-46595,CVE-2026-39835)\n bsc#1265648, CVE-2026-33814,\n","status":"published","published":"2026-06-11T15:29:49Z","modified":"2026-06-16T18:24:43.455656004Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21072-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues\n\nUpdate to version 0.71.2:\n\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267268).\n- CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot\n  evasion (bsc#1268356).\n- CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously\n  crafted image (bsc#1268440).\n- CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's\n  configuration (bsc#1268399).\n- CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation\n  (bsc#1268400).\n- CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked\n  path (bsc#1268404).\n- CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted\n  checkpoint image metadata during container restoration (bsc#1268403).\n\nChanges for trivy:\n\n * release: v0.71.2 [release/v0.71] (#10871)\n * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)\n * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)\n * fix(oci): validate artifact filename\n * fix: forward ospkg detector options through ospkg.NewScanner\n * fix(vex): load VEX documents from within the repository\n   directory\n * fix: surface the original analysis error instead of context\n   cancellation\n * ci: expect GitHub App bot as backport PR author\n","status":"published","published":"2026-06-26T09:25:10Z","modified":"2026-06-30T18:24:30.626245692Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21079-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n  (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n  (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n   also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n   hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n   of document state files\n * Add read-only version check prior to install and uninstall\n   in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n   to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n   cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n   from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n   (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n   both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n","status":"published","published":"2026-06-17T16:32:56Z","modified":"2026-06-30T18:24:39.265293198Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21251-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\nUpdate to version 1.17.0.\n\nSecurity issues fixed:\n\n- CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to\n  denial of service (bsc#1267185).\n- CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a `RangeError` due to a stack overflow\n  and cause to a denial of service (bsc#1260981).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266654).\n- CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected\n  by the server can cause unbounded memory growth and a crash (bsc#1266196).\n- CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns\n  `PartialSuccessError` with non-`nil` permissions (bsc#1266196).\n- CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key\n  parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).\n- CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a\n  connection's read loop and cause a resource leak (bsc#1266196).\n- CVE-2026-39831: golang.org/x/crypto/ssh: missing `User Presence` flag checks in the `Verify()` method for FIDO/U2F\n  security key types cause signatures generated without physical touch to be accepted (bsc#1266196).\n- CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and\n  allow for unrestricted use of a key on a remote host (bsc#1266196).\n- CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by `NewKeyring()` silently accepts keys with the\n  `ConfirmBeforeUse` constraint but never enforces it (bsc#1266196).\n- CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single `Write` call on an SSH channel\n  leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).\n- CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using `CertChecker` as a public\n  key callback without setting `IsUserAuthority` or `IsHostAuthority` can lead to a panic (bsc#1266196).\n- CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an\n  SQL query can lead to a SQL injection (bsc#1265440).\n- CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-42508: golang.org/x/crypto/ssh: revoked `SignatureKey`s belonging to a CA are not correctly checked for\n  revocation (bsc#1266196).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267333).\n- CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are\n  processed (bsc#1267481).\n- CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by `CappedConcurrentHashMap` after removals allows repeated\n  connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).\n- CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes a DoS\n  (bsc#1267488).\n- CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash the OBI process\n  and cause denial of service (bsc#1267489).\n- CVE-2026-46595: golang.org/x/crypto/ssh: source-address validation is skipped if any other type of callback is passed\n  other than public key (bsc#1266196).\n- CVE-2026-46597: golang.org/x/crypto/ssh: incorrectly placed cast from bytes to int in the AES-GCM packet decoder when\n  processing specially crafted input can lead to for server-side panic (bsc#1266196).\n- CVE-2026-46598: golang.org/x/crypto/ssh: `ed25519.PrivateKey` created by casting malformed wire bytes due to\n  processing of certain crafted inputs can lead to panic when used (bsc#1266196).\n\nOther updates and bugfixes:\n\n- Version 1.17.0:\n  * Features\n    * Add GraphQL server and `gql` subcommand.\n    * `otelcol`: Add Nginx receiver.\n    * `otelcol.exporter.prometheus`: Convert classic histograms to NHCB.\n    * `database_observability`: Various enhancements for MySQL and Postgres.\n    * `faro.receiver`: Support gzip-compressed request bodies.\n    * Update to Beyla 3.9.8.\n * Bug Fixes\n   * security: Update `x/crypto`, `x/net`, `jackc/pgx/v5`, and `obi`.\n   * cluster: Fix nodes failing to join the cluster with TLS enabled.\n   * `loki.process`: Fix potential deadlocks and limit stage shutdown.\n   * Update Go to v1.26.4.\n- Version 1.16.3:\n  * cluster: Fix nodes failing to join the cluster when TLS is enabled.\n- Version 1.16.2:\n  * `loki.process`: No longer mutate rules in `stage.truncate` causing every config update to reload pipeline when this\n    stage is used.\n  * `loki.process`: Potential deadlock on update with stage and receiver changes.\n  * `otelcol.exporter.awss3`: Add missing `unique_key_func_name` attribute.\n- Remove dependency on vulnerable `yaml` library.\n","status":"published","published":"2026-07-07T17:00:29Z","modified":"2026-07-09T10:00:11.376074072Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21436-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.74.4 (boo#1267192):\n  * Version v1.74.4\n  * gui: update embedded release to 1.1.10\n  * local: stop --links symlinks escaping the destination directory CVE-2026-54572\n  * local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw\n  * s3: strip STS security token on same-host HTTPS-\u003eHTTP redirect GHSA-cf44-9pgv-m4xc\n  * serve restic: fix --private-repos isolation bypass CVE-2026-59733\n  * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732\n  * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v\n  * build: fix multiple CVEs by upgrading to go1.26.5\n  * s3: fix mounting a prefix failing with 403 when HEAD is not permitted\n  * drive, googlephotos: warn when using rclone's shared client_id #9580\n  * drive: fix stray %!(EXTRA) in unexportable google document log message\n  * serve/http: fix --disable-zip so it works over rc\n  * serve webdav: fix MOVE overwrite failing without Overwrite header\n  * fs: fix negative offset when a suffix Range request exceeds object size\n  * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs\n  * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets\n  * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers\n  * cmd/mount2: fix NFS file creation by implementing Mknod\n  * smb: fix for IBM iSeries and signature verification\n  * mega: fix hard deleted files reappearing in listings - fixes #9554\n  * mega: wait for server events after upload, delete and move\n  * vfs: fix hang reopening a file during the handle-caching grace period\n  * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391\n  * fs: fix command line flag being ignored when set to its default value\n  * docs: fix copy to clipboard functionality for code blocks\n  * fs/operations: correct DeleteFile --backup-dir documentation\n  * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities\n  * docs: clarify copyto command description - Fixes #9527\n  * docs: fix typo in remote setup docs\n  * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188\n  * * s3: fix error mapping in GetObject to match HeadObject\n  * filter: fix --files-from copy stopping at the first unreadable file\n  * docs: Fix RELEASE.md\n  * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0\n  * completion: fix powershell completion corrupting non-ASCII names - fixes #9412\n  * docs/crypt: fix encrypted size example - Fixes #9202\n  * docs: drive: note Google verification exemption for personal use apps\n  * rc: document that rc API access is equivalent to shell access\n  * docs: drive: update documentation about \"Computers\" folder\n  * accounting: fix goroutine leak in ResetCounters\n  * docs: fix --windows-event-log-level help\n  * backend/filelu: fix recursive listing path handling and file filtering\n  * docs: bisync - clarify flag interaction and minor changes\n  * docs: Update RELEASE.md to use cherry-pick -x\n  * webdav: fix mixed property statuses in multi-status responses\n  * s3: remove session token on cross-host redirects\n  * drive: warn when non-exportable Google documents are skipped - #9475\n  * Start v1.74.4-DEV development\n\n- update x/image to 0.43 (bsc#1271056)\n\n- Update to version 1.74.3: (boo#1267869)\n  - Bug Fixes\n    - rc\n      - Fix unauthenticated command execution via --rc-serve inline\n        remotes CVE-2026-49980 (Nick Craig-Wood)\n      - Stop global.* connection string options changing config\n        CVE-2026-49980 (Nick Craig-Wood)\n    - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick\n      Craig-Wood)\n      - CVE-2026-42504: mime: quadratic complexity in\n        WordDecoder.DecodeHeader\n      - CVE-2026-42507: net/textproto: arbitrary input are included\n        in errors without any escaping\n      - CVE-2026-27145: crypto/x509: split candidate hostname only\n        once\n    - log: Fix wrong source file:line in JSON logs from release\n      builds (Nick Craig-Wood)\n    - mount2: Fix empty directory listings on re-read (Janne Beate\n      Bakeng)\n    - serve s3: Fix multipart ListParts pagination returning wrong\n      part numbers (Nick Craig-Wood)\n    - serve sftp\n      - Fix file corruption when a client resumes an upload (Nick\n        Craig-Wood)\n      - Fix truncate request being silently ignored (Nick\n        Craig-Wood)\n    - Local\n      - Fix getXattr returning empty map instead of nil (Leon\n        Brocard)\n  - Drime\n    - Fix server-side copy and move failing with Cloudflare 520\n      error (Nick Craig-Wood)\n    - Fix files being uploaded to the wrong directory (Nick\n      Craig-Wood)\n    - Remove duplicate upload_cutoff config option (Nick\n      Craig-Wood)\n    - Fix directory rename leaving the renamed folder empty in VFS\n      (Nick Craig-Wood)\n  - Drive\n    - Fix server-side move failing on shared drives with duplicate\n      dirs (Nick Craig-Wood)\n  - Iclouddrive\n    - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)\n    - Fix \"Index has invalid data\" error listing iCloud Photos\n      (Nick Craig-Wood)\n\n- Update to version 1.74.2: (boo#1266210)\n  - Bug Fixes\n    - build\n      - Update golang.org/x/net to v0.55.0 to address:\n        - CVE-2026-42506: html: incorrect handling of namespaced\n          elements in foreign content\n        - CVE-2026-39821: idna: failure to reject ASCII-only\n          Punycode-encoded labels\n        - CVE-2026-42502: html: incorrect handling of HTML elements\n          in foreign content\n        - CVE-2026-25680: html: denial of service when parsing\n          arbitrary HTML\n        - CVE-2026-25681: html: incorrect handling of character\n          references in DOCTYPE nodes\n        - CVE-2026-27136: html: duplicate attributes can cause XSS\n      - Update golang.org/x/crypto to v0.52.0 to address:\n        - CVE-2026-46598: ssh/agent: pathological inputs can lead\n          to client panic\n        - CVE-2026-46597: ssh: byte arithmetic causes underflow and\n          panic\n        - CVE-2026-39828: ssh: bypass of certificate restrictions\n        - CVE-2026-39835: ssh: server panic during\n          CheckHostKey/Authenticate\n        - CVE-2026-39833: ssh/agent: key constraints not enforced\n        - CVE-2026-39832: ssh/agent: agent constraints dropped when\n          forwarding keys\n        - CVE-2026-39827: ssh: memory leak when rejecting channels\n          can lead to DoS\n        - CVE-2026-39830: ssh: client can cause server deadlock on\n          unexpected responses\n        - CVE-2026-39829: ssh: pathological RSA/DSA parameters may\n          cause DoS\n        - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys\n          physical interaction\n        - CVE-2026-39834: ssh: infinite loop on large channel\n          writes\n        - CVE-2026-42508: ssh/knownhosts: auth bypass via\n          unenforced @revoked status\n        - CVE-2026-46595: ssh: VerifiedPublicKeyCallback\n          permissions skip enforcement\n      - update golang.org/x/image to v0.41.0 to address:\n        - CVE-2026-42500: bmp: panic when reading out of bound\n          palette index\n        - CVE-2026-33809: tiff: excessive resource consumption in\n          PackBits decompression\n      - Update golang.org/x/sys to version v0.45.0 to address:\n        - CVE-2026-39824: windows: integer overflow in\n          NewNTUnicodeString\n      - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix\n        CVE-2026-44740\n      - bisync: Fix --conflict-loser pathname with\n        --conflict-resolve newer (nielash)\n      - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)\n      - lib/http: Replace deprecated h2c.NewHandler with\n        http.Server.Protocols (Nick Craig-Wood)\n      - rc: Remove duplicate metrics_addr option registration (Nick\n        Craig-Wood)\n      - vfs/vfscache: Fix silent write failure when mounting with\n        remote:. (Lucky945H)\n    - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)\n  - Drime\n    - Fix file doesn't exists error when trying to delete (John\n      Volk)\n    - Fix 500 errors when listing shared folders (Alvinwylim)\n  - Jottacloud\n    - Support whitelabel service Phonero Sky (Tore Anderson)\n  - Protondrive\n    - Fix corrupted on transfer: sha1 hashes differ (William Tange)\n  - S3\n    - Add new MEGA S4 endpoints on megas4.com including\n      Asia-Pacific region (Nick Craig-Wood)\n  - WebDAV\n    - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)\n\n- Update to version 1.74.1:\n  * Version v1.74.1\n  * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814\n  * build: fix multiple CVEs by upgrading to go1.26.3\n  * drime: fix uploads of 100..200M files\n  * drime: fix large file uploads landing in drive root instead of configured folder\n  * docs: sponsor updates\n  * s3: add new Fastly Object Storage regions\n  * cloudinary: fix retrying every error and fix pacer sleep units\n  * s3: fix STS call per request by caching AssumeRole credentials\n  * protondrive: fix segfault when copying files missing revision metadata\n  * protondrive: route library logging through rclone's logger\n  * protondrive: route HTTP through rclone's transport\n  * bisync: fix retryable without --resync error message when --resync has a critical failure\n  * cmd/serve/s3: return object listings in key order\n  * Start v1.74.1-DEV development\n\n- Update to version 1.74.0:\n  * Version v1.74.0\n  * docs: add missing Huawei Drive docs\n  * Add Huawei Drive support\n  * s3: add Impossible Cloud as a new S3 provider\n  * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI\n  * gui: embed compressed dist.zip in the binary for smaller, reproducible builds\n  * docs: update the GUI docs to reflect the new `rclone gui`\n  * Add John Volk to contributors\n  * drime: fix listings of large directories\n  * docs: fix iCloud docs after website update (missed in the merge)\n  * protondrive: fix server-side moveto and DirMove against current API\n  * build: Update all packages with pseudo versions which aren't v0.0.0\n  * Add Chris Coughlan to contributors\n  * Add Yakov Till to contributors\n  * iclouddrive: add read only  iCloud Photos support and SRP authentication\n  * mountlib: rc: fix mounts created with mountPoint \"*\" overwriting each other\n  * vfs/vfscache/downloaders: kick waiters periodically, not just once\n  * rc: add user directories to core/disks and filter mounts better\n  * docs: notes on how to update pseudo versions\n  * Add dlaumen to contributors\n  * Add Luke Cyca to contributors\n  * Add mathieulongtin to contributors\n  * protondrive: update to latest go-proton-api to use new host\n  * docs: amend Google Drive client_id instructions to include running web-based auth flow\n  * azureblob,azurefile: fix documentation about federated identity\n  * internxt: implement multi-part uploads\n  * serve dlna: remove file extensions from titles to prevent Samsung TV duplication\n  * serve dlna: fix XML quote escaping for Samsung TV compatibility\n  * serve dlna: handle empty ObjectID from Samsung TVs\n  * serve dlna: add Samsung-specific XML namespace\n  * serve dlna: fix invalid dc:date for containers\n  * serve dlna: fix container childCount to reflect actual contents\n  * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility\n  * Add Anton Bordwine to contributors\n  * listremotes: add --exact flag for filtering - fixes #9076\n  * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952\n  * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367\n  * Add tdawe to contributors\n  * Add Jan Heylen to contributors\n  * protondrive: align backend with newer Proton SDK stack\n  * s3: fix bucket creation failing on Ceph/radosgw\n  * rc: add core/disks to enumerate attached disks\n  * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813\n  * Add SyoBoN to contributors\n  * docs: fix typo\n  * docs: fix code comment regarding cmount tag\n  * s3: add HCP provider and list_versions_oldest_first quirk\n  * mega: fix crash when logging in with previous auth keys fails\n  * pcloud: fix recursive listing from the root - fixes #9315\n  * rc: flip auth default so all endpoints require auth unless opted out\n  * Changelog updates from Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * accounting: fix rcat/copyurl for files.com\n  * bisync: fix integration tests after sftp log changes\n  * build: bump actions/github-script from 8 to 9\n  * fstest/test_all: stop test servers on signal, panic, or exit\n  * fstest/testserver: add CleanupAll for end-of-run server sweep\n  * fstest/testserver: add force-stop and reconcile stale refcounts\n  * fshttp: add --dump curl for dumping HTTP requests as curl commands\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * serve nfs: fix EOF flag in READ response not being set when read reaches end of file\n  * webdav: optimize performance by using Depth=0 for metadata requests\n  * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy\n  * azureblob: add --azureblob-decompress flag to download gzip-encoded files\n  * docs: serve backend metadata as JSON on the website\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * vfs: add context parameter to New() for config propagation\n  * vfs: replace context.TODO/Background with stored VFS context\n  * build: fix `make fetch-gui` in CI workflow - it was in the wrong place\n  * gui: join Wait goroutines on shutdown\n  * gui: remove flag.Lookup test guard around browser open\n  * gui: drop freePort helper, use libhttp port binding for the RC server\n  * gui: allow serving from a local zip file or an unpacked directory\n  * gui: don't run fetch-gui on make\n  * build: fix GitHub API rate limit errors when fetching GUI dist in CI\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filen: make multi-threaded upload chunks individually retryable\n  * chore: add Enduriel as filen backend maintainer\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * Add Mozi to contributors\n  * Add Brais Couce to contributors\n  * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails\n  * iclouddrive: fix 'directory not found' error when the directory contains accent marks\n  * downloaders: fix flaky TestDownloaders/EnsureDownloader test\n  * sftp: warn the user if no host key validation is configured\n  * Add TheBabu to contributors\n  * lib/http: Add HTTP/2 cleartext support in server configuration\n  * build: add explicit permissions to GitHub Actions workflows\n  * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file\n  * webdav: Add a section on symlink/junction points in the help\n  * Changelog updates from Version v1.73.4\n  * build: update all dependencies\n  * docs: fix XSS vulnerability in dropdown mobile header\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * linkbox: fix downloading files by using web API - fixes #8665\n  * vfs: fix tests after --vfs-handle-caching\n  * Add Suyun to contributors\n  * build: fix loong64 and s390x build\n  * jottacloud: add encoding of percent character to default backend encoding\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * vfs: fix slow nfs serve by adding --vfs-handle-caching\n  * Add Xiangzhe to contributors\n  * Add Mike GIllan to contributors\n  * fix(docs): Fix link to not be language specific\n  * iclouddrive: lowercase Apple ID for SRP authentication\n  * iclouddrive: use dynamic origin for SRP auth headers\n  * iclouddrive: replace plaintext signin with SRP authentication\n  * docs: modernize rclone.org site design\n  * Add Andriy Senyshyn to contributors\n  * Add Claude Opus 4.6 to contributors\n  * Add jinyu.han to contributors\n  * Add jinkeyuu to contributors\n  * Add lif to contributors\n  * Add BizaNator to contributors\n  * Add Patrick Farrell to contributors\n  * Add Jason to contributors\n  * Add ZRHan to contributors\n  * Add Andrew Furman to contributors\n  * Add Andriy Senyshyn to contributors\n  * Add Bhagyashreek8 to contributors\n  * s3: add UCloud Object Storage provider (#9230)\n  * bisync: fix handling of unreadable lockfiles - fixes #9290\n  * librclone/ctest: add Windows support and fix memory management\n  * s3: fix regression where PutObject fails with non-seekable readers\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Add OVHcloud storage classes\n  * local: remove fadvise calls that cause spinlock contention\n  * Changelog updates from Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * webdav: request only required properties in listAll to improve performance\n  * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * copyurl: fix ignored --upload-headers and --download-headers\n  * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * Add Billy Hughes to contributors\n  * accounting: Add deletedDirs stat to core/stats help output\n  * docs: added text to the label showing version-introduced info\n  * Changelog updates from Version v1.73.2\n  * fs/log: fix data race on OutputHandler.format field\n  * build(deps): bump docker/build-push-action from 6 to 7\n  * build(deps): bump docker/setup-buildx-action from 3 to 4\n  * build(deps): bump docker/metadata-action from 5 to 6\n  * build(deps): bump docker/setup-qemu-action from 3 to 4\n  * build(deps): bump docker/login-action from 3 to 4\n  * bisync: update changelog\n  * bisync: auto-generate rc help docs\n  * bisync: add more structured info to rc output\n  * bisync: add missing rc params - fixes #7799\n  * operations: multithread copy: grab memory before making go routines\n  * b2: add server side copy real time accounting\n  * s3: add server side copy real time accounting\n  * azureblob: add server side copy real time accounting\n  * operations: add method to real time account server side copy\n  * Add Duncan F to contributors\n  * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency\n  * Add razorloves to contributors\n  * docs: fix new drive flag typo in changelog\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * Add Bjoern Franke to contributors\n  * Add Brian Bockelman to contributors\n  * Add Romāns Potašovs to contributors\n  * Add Adam Kasztenny to contributors\n  * Add hxnd to contributors\n  * Add Bjoern Franke to contributors\n  * Add FTCHD to contributors\n  * build(deps): bump actions/upload-artifact from 6 to 7\n  * build(deps): bump actions/download-artifact from 7 to 8\n  * serve http: add gzip compression\n  * webdav: permit redirects on PROPFIND for metadata\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * touch: add metadata when using `--metadata-set`\n  * s3: ionos: updated regions \u0026 endpoints\n  * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR\n  * drive: add integration test for handling folder names with single quotes\n  * http: dark mode for browser\n  * docs: note that --use-server-modtime only works on some backends\n  * Add a1pcm to contributors\n  * Add Leon Brocard to contributors\n  * Add Dark Dragon to contributors\n  * internxt: fix Entry doesn't belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * s3: add new Fastly Object Storage regions\n  * docs: Fix headers hierarchy for mount.md\n  * serve http: add fallback embedded favicon\n  * graphics: optimise images losslessly with ImageOptim\n  * docs: update sponsors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Chris to contributors\n  * Add Shlomi Avihou to contributors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Varun Chawla to contributors\n  * Add Prakhar Chhalotre to contributors\n  * s3: add Object Lock support\n  * webdav: escape reserved characters in URL path segments\n  * s3: add Zadara Object Storage provider\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * accounting: update String method output format for clarity in transfer rate representation - fixes #9129\n  * docs: add instructions on how to update Go version\n  * build: modernize Go code with go fix for go1.25\n  * build: update all dependencies\n  * lib/rest: remove go1.24 workaround now go1.25 is the minimum\n  * build: update to go1.26 and make go1.25 the minimum required version\n  * Add Jack Kelly to contributors\n  * Changelog updates from Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * test_all: increase retries for Internxt eventual consistency\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * Add kingston125 to contributors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * filelu: migrate API calls to lib/rest\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * Add Cohinem to contributors\n  * Add Leon Brocard to contributors\n  * s3: remove StackPath Object Storage provider\n  * drime: implement About\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * s3: add Fastly Object Storage provider\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * pikpak: support custom filenames for addurl backend command - fixes #9111\n  * Start v1.74.0-DEV development\n","status":"published","published":"2026-07-22T20:54:49Z","modified":"2026-07-24T17:16:08.404400958Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21551-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:38:07Z","modified":"2026-08-12T18:23:41.809969353Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22157-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n  (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n  (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n   also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n   hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n   of document state files\n * Add read-only version check prior to install and uninstall\n   in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n   to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n   cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n   from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n   (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n   both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n","status":"published","published":"2026-06-17T16:31:19Z","modified":"2026-06-24T18:24:16.649027299Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22575-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\nUpdate to version 1.17.0.\n\nSecurity issues fixed:\n\n- CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to\n  denial of service (bsc#1267185).\n- CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a `RangeError` due to a stack overflow\n  and cause to a denial of service (bsc#1260981).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266654).\n- CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected\n  by the server can cause unbounded memory growth and a crash (bsc#1266196).\n- CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns\n  `PartialSuccessError` with non-`nil` permissions (bsc#1266196).\n- CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key\n  parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).\n- CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a\n  connection's read loop and cause a resource leak (bsc#1266196).\n- CVE-2026-39831: golang.org/x/crypto/ssh: missing `User Presence` flag checks in the `Verify()` method for FIDO/U2F\n  security key types cause signatures generated without physical touch to be accepted (bsc#1266196).\n- CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and\n  allow for unrestricted use of a key on a remote host (bsc#1266196).\n- CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by `NewKeyring()` silently accepts keys with the\n  `ConfirmBeforeUse` constraint but never enforces it (bsc#1266196).\n- CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single `Write` call on an SSH channel\n  leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).\n- CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using `CertChecker` as a public\n  key callback without setting `IsUserAuthority` or `IsHostAuthority` can lead to a panic (bsc#1266196).\n- CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an\n  SQL query can lead to a SQL injection (bsc#1265440).\n- CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an\n  unexpected HTML tree and allows for XSS (bsc#1267185).\n- CVE-2026-42508: golang.org/x/crypto/ssh: revoked `SignatureKey`s belonging to a CA are not correctly checked for\n  revocation (bsc#1266196).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267333).\n- CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are\n  processed (bsc#1267481).\n- CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by `CappedConcurrentHashMap` after removals allows repeated\n  connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).\n- CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes a DoS\n  (bsc#1267488).\n- CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash the OBI process\n  and cause denial of service (bsc#1267489).\n- CVE-2026-46595: golang.org/x/crypto/ssh: source-address validation is skipped if any other type of callback is passed\n  other than public key (bsc#1266196).\n- CVE-2026-46597: golang.org/x/crypto/ssh: incorrectly placed cast from bytes to int in the AES-GCM packet decoder when\n  processing specially crafted input can lead to for server-side panic (bsc#1266196).\n- CVE-2026-46598: golang.org/x/crypto/ssh: `ed25519.PrivateKey` created by casting malformed wire bytes due to\n  processing of certain crafted inputs can lead to panic when used (bsc#1266196).\n\nOther updates and bugfixes:\n\n- Version 1.17.0:\n  * Features\n    * Add GraphQL server and `gql` subcommand.\n    * `otelcol`: Add Nginx receiver.\n    * `otelcol.exporter.prometheus`: Convert classic histograms to NHCB.\n    * `database_observability`: Various enhancements for MySQL and Postgres.\n    * `faro.receiver`: Support gzip-compressed request bodies.\n    * Update to Beyla 3.9.8.\n * Bug Fixes\n   * security: Update `x/crypto`, `x/net`, `jackc/pgx/v5`, and `obi`.\n   * cluster: Fix nodes failing to join the cluster with TLS enabled.\n   * `loki.process`: Fix potential deadlocks and limit stage shutdown.\n   * Update Go to v1.26.4.\n- Version 1.16.3:\n  * cluster: Fix nodes failing to join the cluster when TLS is enabled.\n- Version 1.16.2:\n  * `loki.process`: No longer mutate rules in `stage.truncate` causing every config update to reload pipeline when this\n    stage is used.\n  * `loki.process`: Potential deadlock on update with stage and receiver changes.\n  * `otelcol.exporter.awss3`: Add missing `unique_key_func_name` attribute.\n- Remove dependency on vulnerable `yaml` library.\n","status":"published","published":"2026-07-07T16:59:00Z","modified":"2026-07-15T18:24:12.554767538Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23216-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:09.233788558Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23227-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:10.174179412Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2467-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\t\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n  (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n  (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n   also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n   hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n   of document state files\n * Add read-only version check prior to install and uninstall\n   in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n   to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n   cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n   from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n   (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n   both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n","status":"published","published":"2026-06-19T11:03:15Z","modified":"2026-06-20T08:45:06.354467983Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2468-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\t\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n  (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n  (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n   also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n   hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n   of document state files\n * Add read-only version check prior to install and uninstall\n   in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n   to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n   cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n   from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n   (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n   both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n","status":"published","published":"2026-06-19T11:03:24Z","modified":"2026-06-20T08:45:07.124068812Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2824-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues\n\n- CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing malformed ELF/BTF input (bsc#1267811).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267185).\n- CVE-2026-33532: Denial of Service via deeply nested YAML document parsing (bsc#1260981).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1266196).\n- CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: SQL injection when placeholders in dollar-quoted string literals are used in the SQL query (bsc#1265440).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).\n- CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).\n- CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by `CappedConcurrentHashMap` after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).\n- CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes a DoS (bsc#1267488).\n- CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash the OBI process and cause denial of service (bsc#1267489).\n","status":"published","published":"2026-07-09T18:18:01Z","modified":"2026-07-10T10:00:07.74997054Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3056-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241728).\n- CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).\n- CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents\n  (bsc#1251365).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type\n  in response to a key listing or signing request (bsc#1253508 bsc#1253517).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1253980 bsc#1253983).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253797 bsc#1253799).\n- CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by\n  `html.ParseFragment` (bsc#1251559).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267058).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx`\n  files can lead to the consumption of corrupted files (bsc#1258096).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path` \n  pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112\n  bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an\n  out-of-bounds read and potential information disclosure (bsc#1263313).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service\n  via stack exhaustion (bsc#1263247).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n","status":"published","published":"2026-07-15T13:28:46Z","modified":"2026-07-16T10:00:15.0086061Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:4628-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278462 bsc#1278477 bsc#1278505).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276980).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276990).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278269 bsc#1279243 bsc#1279245 bsc#1279252 bsc#1279263\n  bsc#1279386).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278272\n  bsc#1279072 bsc#1279080 bsc#1279137).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278742 bsc#1278743 bsc#1278751 bsc#1278763).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1278267).\n\nNon security issue fixed:\n\n- terraform-provider-{aws,external,google,random,tls}: aarch64 build installs provider binary under linux_amd64 instead\n  of linux_arm64, breaking terraform init (bsc#1280175).\n","status":"published","published":"2026-10-12T14:58:46Z","modified":"2026-10-13T10:30:05.946541838Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}