{"id":"CVE-2026-56854","aliases":["BELL-CVE-2026-56854","DEBIAN-CVE-2026-56854","EUVD-2026-67741","GHSA-gjhq-gjfw-99mq","GO-2026-6303","MGASA-2026-0586","SUSE-SU-2026:23692-1","SUSE-SU-2026:23712-1","SUSE-SU-2026:23736-1","SUSE-SU-2026:23739-1","SUSE-SU-2026:23745-1","SUSE-SU-2026:23831-1","SUSE-SU-2026:23841-1","SUSE-SU-2026:23874-1","SUSE-SU-2026:23876-1","SUSE-SU-2026:23924-1","SUSE-SU-2026:23973-1","SUSE-SU-2026:23984-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:24213-1","SUSE-SU-2026:24282-1","SUSE-SU-2026:4209-1","SUSE-SU-2026:4270-1","SUSE-SU-2026:4272-1","SUSE-SU-2026:4286-1","SUSE-SU-2026:4292-1","SUSE-SU-2026:4293-1","SUSE-SU-2026:4308-1","SUSE-SU-2026:4372-1","SUSE-SU-2026:4392-1","SUSE-SU-2026:4408-1","SUSE-SU-2026:4628-1","SUSE-SU-2026:5167-1","UBUNTU-CVE-2026-56854","openSUSE-SU-2026:11699-1","openSUSE-SU-2026:11727-1","openSUSE-SU-2026:11731-1","openSUSE-SU-2026:11732-1","openSUSE-SU-2026:11751-1","openSUSE-SU-2026:11752-1","openSUSE-SU-2026:11803-1","openSUSE-SU-2026:11811-1","openSUSE-SU-2026:11813-1","openSUSE-SU-2026:11830-1","openSUSE-SU-2026:12241-1","openSUSE-SU-2026:12258-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21812-1","openSUSE-SU-2026:21814-1","openSUSE-SU-2026:21816-1","openSUSE-SU-2026:21824-1","openSUSE-SU-2026:21835-1","openSUSE-SU-2026:21841-1","openSUSE-SU-2026:21846-1","openSUSE-SU-2026:21861-1","openSUSE-SU-2026:21879-1","openSUSE-SU-2026:21882-1","openSUSE-SU-2026:21884-1","openSUSE-SU-2026:21924-1","openSUSE-SU-2026:21927-1","openSUSE-SU-2026:21983-1","openSUSE-SU-2026:21999-1","openSUSE-SU-2026:22032-1","openSUSE-SU-2026:22064-1"],"status":"published","title":"Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00437,"percentile":0.38453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-28T14:47:45Z","modified":"2026-11-11T13:00:04Z","fixes":[{"ecosystem":"Debian:14","package":"golang-go.crypto","fixed_in":["1:0.55.0-1"],"sources":["osv"]},{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.55.0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","fixed_in":["20260908.00-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","fixed_in":["3.3.5390.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.40.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"calicoctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cilium-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0-r12"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"docker-cli-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20250521.00-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"osv-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rootlesskit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"calicoctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cilium-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0-r12"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.2-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker-cli-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.4-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20250214.01-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.100.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.35.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"osv-scanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rootlesskit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.12.0-1","1:0.13.0-1","1:0.14.0-1","1:0.16.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.21.0-1","1:0.22.0-1","1:0.23.0-1","1:0.24.0-1","1:0.24.0-2","1:0.25.0-1","1:0.25.0-1~bpo12+1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.4.0-1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.55.0-1"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1"]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.55.0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-2.mga10"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-150700.9.14.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.75.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-4.52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.42.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20150608-1","1:0.0~git20151201.0.7b85b09-2","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-0ubuntu4","0.21-0ubuntu3","0.21-0ubuntu5","0.22-0ubuntu1","0.22-0ubuntu2","0.23-0ubuntu1","0.23-0ubuntu2","0.23-0ubuntu3","0.24-0ubuntu2","0.24-0ubuntu3","0.24-0ubuntu4","0.25-0ubuntu1","0.26-0ubuntu2","0.26-0ubuntu3","0.27-0ubuntu1","0.27-0ubuntu2","2.0.0~beta1-0ubuntu3","2.0.0~beta1-0ubuntu4","2.0.0~beta2-0ubuntu1","2.0.0~beta2-0ubuntu2","2.0.0~beta3-0ubuntu1","2.0.0~beta3-0ubuntu2","2.0.0~beta3-0ubuntu3","2.0.0~beta3-0ubuntu4","2.0.0~beta4-0ubuntu1","2.0.0~beta4-0ubuntu2","2.0.0~beta4-0ubuntu3","2.0.0~beta4-0ubuntu4","2.0.0~beta4-0ubuntu5","2.0.0~beta4-0ubuntu6","2.0.0~beta4-0ubuntu7","2.0.0~rc1-0ubuntu1","2.0.0~rc1-0ubuntu2","2.0.0~rc1-0ubuntu3","2.0.0~rc2-0ubuntu2","2.0.0~rc2-0ubuntu3","2.0.0~rc3-0ubuntu1","2.0.0~rc3-0ubuntu2","2.0.0~rc3-0ubuntu3","2.0.0~rc3-0ubuntu4","2.0.0~rc4-0ubuntu1","2.0.0~rc5-0ubuntu1","2.0.0~rc6-0ubuntu1","2.0.0~rc6-0ubuntu2","2.0.0~rc7-0ubuntu1","2.0.0~rc7-0ubuntu2","2.0.0~rc8-0ubuntu1","2.0.0~rc8-0ubuntu2","2.0.0~rc8-0ubuntu3","2.0.0~rc8-0ubuntu5","2.0.0~rc8-0ubuntu6","2.0.0~rc8-0ubuntu7","2.0.0~rc9-0ubuntu2","2.0.0~rc9-0ubuntu3","2.0.0~rc9-0ubuntu4","2.0.0~rc9-0ubuntu5","2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.1-0ubuntu1~16.04.1","2.0.2-0ubuntu1~16.04.1","2.0.3-0ubuntu1~ubuntu16.04.2","2.0.4-0ubuntu1~ubuntu16.04.1","2.0.5-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.2","2.0.9-0ubuntu1~16.04.1","2.0.9-0ubuntu1~16.04.2","2.0.10-0ubuntu1~16.04.1","2.0.10-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.4","2.0.11-0ubuntu1~16.04.4+esm1","2.0.11-0ubuntu1~16.04.4+esm2","2.0.11-0ubuntu1~16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4","2.37.4ubuntu0.1","2.38","2.39.2","2.39.2ubuntu0.2","2.40","2.42.1","2.45.1","2.45.1ubuntu0.2","2.46.1","2.47.1","2.48","2.48.3","2.54.3+16.04~esm2","2.54.3+16.04.0ubuntu0.1~esm3","2.54.3+16.04.0ubuntu0.1~esm4","2.54.3+16.04.0ubuntu0.1~esm5","2.54.3+16.04.0ubuntu0.1~esm6","2.61.4ubuntu0.16.04.1+esm1","2.61.4ubuntu0.16.04.1+esm2","2.61.4ubuntu0.16.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1","20240716.00-0ubuntu1~16.04.0+esm2","20240716.00-0ubuntu1~16.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18-0ubuntu6","2.19-0ubuntu1","2.20-0ubuntu3","2.20-0ubuntu4","2.21-0ubuntu1","2.21-0ubuntu2","2.21-0ubuntu3","2.21-0ubuntu4","3.0.0~beta2-0ubuntu3","3.0.0~beta3-0ubuntu3","3.0.0~beta5-0ubuntu2","3.0.0~beta7-0ubuntu1","3.0.0-0ubuntu1","3.0.0-0ubuntu2","3.0.0-0ubuntu3","3.0.0-0ubuntu4","3.0.1-0ubuntu1~18.04.1","3.0.2-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.2","3.0.3-0ubuntu1~18.04.2+esm1","3.0.3-0ubuntu1~18.04.2+esm2","3.0.3-0ubuntu1~18.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04","2.37.4+18.04.1","2.38+18.04","2.39.2+18.04","2.40+18.04","2.42.1+18.04","2.45.1+18.04","2.45.1+18.04.2","2.46.1+18.04","2.47.1+18.04","2.48+18.04","2.48.3+18.04","2.49.2+18.04","2.51.1+18.04","2.54.2+18.04ubuntu1","2.54.3+18.04","2.54.3+18.04.2ubuntu0.1","2.54.3+18.04.2ubuntu0.2","2.55.5+18.04","2.57.5+18.04","2.57.5+18.04ubuntu0.1","2.58+18.04","2.58+18.04.1","2.61.4ubuntu0.18.04.1+esm1","2.61.4ubuntu0.18.04.1+esm2","2.61.4ubuntu0.18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20170629.0.5ef0053-1ubuntu1","1:0.0~git20170629.0.5ef0053-1ubuntu2","1:0.0~git20170629.0.5ef0053-2","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0+esm1","20241011.01-0ubuntu1~18.04.0+esm2","20241011.01-0ubuntu1~18.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0","20250116.00-0ubuntu1~20.04.0+esm1","20250116.00-0ubuntu1~20.04.0+esm2","20250116.00-0ubuntu1~20.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41+19.10.1","2.42.1+20.04","2.43.3+git1.8109f8","2.44~pre1+20.04","2.44+20.04","2.44.2+20.04","2.44.3+20.04","2.45.1+20.04","2.45.1+20.04.2","2.46.1+20.04","2.47.1+20.04","2.48+20.04","2.48.3+20.04","2.49.2+20.04","2.51.1+20.04ubuntu2","2.54.2+20.04ubuntu2","2.54.3+20.04","2.54.3+20.04.1","2.54.3+20.04.1ubuntu0.1","2.54.3+20.04.1ubuntu0.2","2.54.3+20.04.1ubuntu0.3","2.55.5+20.04","2.57.5+20.04","2.57.5+20.04ubuntu0.1","2.58+20.04","2.58+20.04.1","2.61.3+20.04","2.62+20.04","2.63+20.04","2.63+20.04ubuntu0.1","2.65.3+20.04","2.66.1+20.04","2.67.1+20.04","2.67.1+20.04ubuntu1~esm1","2.67.1+20.04ubuntu1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20190701.4def268-2","1:0.0~git20200221.2aa609c-1","1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1","1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2","1:0.0~git20200221.2aa609c-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.1","20250116.00-0ubuntu1~22.04.2","20250116.00-0ubuntu1~22.04.3","20250116.00-0ubuntu1~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20201221.eec23a3-1","1:0.0~git20211202.5770296-1","1:0.0~git20211202.5770296-1ubuntu0.1~esm1","1:0.0~git20211202.5770296-1ubuntu0.1~esm2","1:0.0~git20211202.5770296-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1","20250116.00-0ubuntu1~24.04.2","20250116.00-0ubuntu1~24.04.3","20250116.00-0ubuntu1~24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.4.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.19.0-1ubuntu0.1~esm1","1:0.19.0-1ubuntu0.1~esm2","1:0.19.0-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.47.0-1","1:0.55.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250506.01-0ubuntu2","20250506.01-0ubuntu3","20260819.00+~20260819.00-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.1+ubuntu26.04.4","2.76+ubuntu26.10.1","2.76+ubuntu26.10.2","2.76.3+ubuntu26.10","2.77.1+ubuntu26.10.1","2.78+ubuntu26.10"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250506.01-0ubuntu1","20250506.01-0ubuntu2","20250506.01-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.45.0-1","1:0.47.0-1","1:0.47.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.00-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.66","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.66.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.9.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.7-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.6-bp160.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-160000.3.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"keybase-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp160.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.100.0-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.9.1-bp160.1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp160.4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.1-bp160.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh"}],"references":[{"url":"https://go.dev/issue/80213","tags":["report"]},{"url":"https://go.dev/cl/797040","tags":["fix","report"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6303","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56854"},{"url":"https://github.com/advisories/GHSA-gjhq-gjfw-99mq"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56854","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56854","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0586.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35806","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-75-2-2026-10-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-1-2026-09-04","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-0-2026-07-31","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-74-4-2026-07-08","tags":["web"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623692-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623712-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253357","tags":["report"]},{"url":"https://bugzilla.suse.com/1272118","tags":["report"]},{"url":"https://bugzilla.suse.com/1278597","tags":["report"]},{"url":"https://bugzilla.suse.com/1278967","tags":["report"]},{"url":"https://bugzilla.suse.com/1279297","tags":["report"]},{"url":"https://bugzilla.suse.com/1279414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623745-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623831-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623841-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623874-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276722","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623924-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272117","tags":["report"]},{"url":"https://bugzilla.suse.com/1278614","tags":["report"]},{"url":"https://bugzilla.suse.com/1279215","tags":["report"]},{"url":"https://bugzilla.suse.com/1282542","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264209-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248946","tags":["report"]},{"url":"https://bugzilla.suse.com/1262952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265799","tags":["report"]},{"url":"https://bugzilla.suse.com/1266179","tags":["report"]},{"url":"https://bugzilla.suse.com/1266639","tags":["report"]},{"url":"https://bugzilla.suse.com/1267176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272064","tags":["report"]},{"url":"https://bugzilla.suse.com/1276687","tags":["report"]},{"url":"https://bugzilla.suse.com/1278621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264270-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264272-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264286-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276981","tags":["report"]},{"url":"https://bugzilla.suse.com/1276994","tags":["report"]},{"url":"https://bugzilla.suse.com/1278681","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264293-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264308-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278666","tags":["report"]},{"url":"https://bugzilla.suse.com/1279033","tags":["report"]},{"url":"https://bugzilla.suse.com/1279236","tags":["report"]},{"url":"https://bugzilla.suse.com/1279333","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264372-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264392-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://bugzilla.suse.com/1276980","tags":["report"]},{"url":"https://bugzilla.suse.com/1276990","tags":["report"]},{"url":"https://bugzilla.suse.com/1278267","tags":["report"]},{"url":"https://bugzilla.suse.com/1278269","tags":["report"]},{"url":"https://bugzilla.suse.com/1278272","tags":["report"]},{"url":"https://bugzilla.suse.com/1278462","tags":["report"]},{"url":"https://bugzilla.suse.com/1278477","tags":["report"]},{"url":"https://bugzilla.suse.com/1278505","tags":["report"]},{"url":"https://bugzilla.suse.com/1278742","tags":["report"]},{"url":"https://bugzilla.suse.com/1278743","tags":["report"]},{"url":"https://bugzilla.suse.com/1278751","tags":["report"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279080","tags":["report"]},{"url":"https://bugzilla.suse.com/1279137","tags":["report"]},{"url":"https://bugzilla.suse.com/1279243","tags":["report"]},{"url":"https://bugzilla.suse.com/1279245","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://bugzilla.suse.com/1279263","tags":["report"]},{"url":"https://bugzilla.suse.com/1279386","tags":["report"]},{"url":"https://bugzilla.suse.com/1280175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265167-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278574","tags":["report"]},{"url":"https://bugzilla.suse.com/1278869","tags":["report"]},{"url":"https://bugzilla.suse.com/1279184","tags":["report"]},{"url":"https://bugzilla.suse.com/1279276","tags":["report"]},{"url":"https://bugzilla.suse.com/1285255","tags":["report"]},{"url":"https://bugzilla.suse.com/1286984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287039","tags":["report"]},{"url":"https://bugzilla.suse.com/1287131","tags":["report"]},{"url":"https://bugzilla.suse.com/1287260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-56854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56854","tags":["report"]},{"url":"https://github.com/golang/go/issues/80213","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75890","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://bugzilla.suse.com/1278447","tags":["report"]},{"url":"https://bugzilla.suse.com/1278625","tags":["report"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1278584","tags":["report"]},{"url":"https://bugzilla.suse.com/1238699","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241838","tags":["report"]},{"url":"https://bugzilla.suse.com/1251495","tags":["report"]},{"url":"https://bugzilla.suse.com/1251689","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1260295","tags":["report"]},{"url":"https://bugzilla.suse.com/1262269","tags":["report"]},{"url":"https://bugzilla.suse.com/1279234","tags":["report"]},{"url":"https://bugzilla.suse.com/1279315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://bugzilla.suse.com/1280111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://bugzilla.suse.com/1278934","tags":["report"]},{"url":"https://bugzilla.suse.com/1279296","tags":["report"]},{"url":"https://bugzilla.suse.com/1279416","tags":["report"]},{"url":"https://bugzilla.suse.com/1278586","tags":["report"]},{"url":"https://bugzilla.suse.com/1278604","tags":["report"]},{"url":"https://bugzilla.suse.com/1266208","tags":["report"]},{"url":"https://bugzilla.suse.com/1276703","tags":["report"]},{"url":"https://bugzilla.suse.com/1278643","tags":["report"]},{"url":"https://bugzilla.suse.com/1279548","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-56854","title":"Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T15:14:26.918Z","modified":"2026-08-28T20:17:17.397Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-67741","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T15:14:26Z","modified":"2026-08-28T20:17:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:22.342607Z"}],"ghsa":[{"id":"GHSA-gjhq-gjfw-99mq","title":"The source-address critical option in the Permissions returned by an authentication callback was...","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T18:31:29Z","modified":"2026-08-29T00:32:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:11:09.499721Z"}],"nvd":[{"id":"CVE-2026-56854","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T16:18:17.607Z","modified":"2026-09-03T16:37:52.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"BELL-CVE-2026-56854","status":"published","published":"2026-08-30T06:03:20.562228Z","modified":"2026-09-04T07:15:09.545435457Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"DEBIAN-CVE-2026-56854","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T16:18:17.607Z","modified":"2026-10-01T03:03:27.181137948Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-56854","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T16:18:00Z","modified":"2026-11-11T09:40:07.690742904Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-11T10:02:12.942344Z"},{"id":"GO-2026-6303","title":"Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh","description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","status":"published","published":"2026-08-28T14:47:45Z","modified":"2026-08-29T10:10:52.440319762Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"MGASA-2026-0586","title":"Updated rclone package fixes security vulnerabilities","description":"This update brings new features, bugs and vulnerabilities fixed in the\nrclone and golang components used to build it.\n","status":"published","published":"2026-11-10T16:31:41Z","modified":"2026-11-10T16:45:03.103329652Z","updated_at":"2026-11-10T17:04:13.670671Z"},{"id":"openSUSE-SU-2026:11699-1","title":"google-guest-agent-20260903.00-1.1 on GA media","description":"These are all security issues fixed in the google-guest-agent-20260903.00-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:06.023087245Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11727-1","title":"rclone-1.75.1-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:04.97152798Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11731-1","title":"containerized-data-importer1.65-api-1.65.0-3.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:22.462847721Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11732-1","title":"containerized-data-importer1.66-api-1.66.1-1.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:18.656014419Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11751-1","title":"google-osconfig-agent-20260908.00-2.1 on GA media","description":"These are all security issues fixed in the google-osconfig-agent-20260908.00-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.323383414Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11752-1","title":"kubevirt1.9-container-disk-1.9.0-3.1 on GA media","description":"These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.339908969Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11803-1","title":"alloy-1.19.2-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-09-18T18:23:08.624887714Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11811-1","title":"amazon-ssm-agent-3.3.5390.0-1.1 on GA media","description":"These are all security issues fixed in the amazon-ssm-agent-3.3.5390.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-18T00:00:00Z","modified":"2026-09-19T18:23:08.020213981Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11813-1","title":"cloudflared-2026.9.1-1.1 on GA media","description":"These are all security issues fixed in the cloudflared-2026.9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-18T00:00:00Z","modified":"2026-09-19T18:23:08.081110172Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11830-1","title":"apptainer-1.5.3-4.1 on GA media","description":"These are all security issues fixed in the apptainer-1.5.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:08.566829939Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12241-1","title":"kubevirt1.8-container-disk-1.8.4-7.1 on GA media","description":"These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:09.36502555Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12258-1","title":"zk-0.15.7-1.1 on GA media","description":"These are all security issues fixed in the zk-0.15.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:12.83344843Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA\n  certificates (bsc#1258543).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278624).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279390).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1279392).\n","status":"published","published":"2026-09-07T15:03:57Z","modified":"2026-09-10T18:23:46.123242111Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21812-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:52:09Z","modified":"2026-09-10T18:23:18.964541257Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21814-1","title":"Security update for zk","description":"This update for zk fixes the following issues:\n\nChanges in zk:\n\n- Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447):\n  * Upgrade golang.org/x/crypto to v0.56.0 to fix security\n    vulnerabilities in the embedded x/crypto/ssh package:\n    - CVE-2026-56854: authentication bypass\n    - CVE-2026-56855: deadlock vulnerability\n    - CVE-2026-78662: deadlock vulnerability\n","status":"published","published":"2026-09-08T09:46:55Z","modified":"2026-09-10T18:23:18.955090295Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21816-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).\n","status":"published","published":"2026-09-09T13:49:24Z","modified":"2026-09-10T17:00:03.90592706Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","description":"This update for containerized-data-importer1.65 fixes the following issues:\n\n- CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241838).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251495).\n- CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or\n  (bsc#1253506).\n- CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).\n- CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).\n- CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251689).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267176).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260295).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265799).\n- CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262952).\n- CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service\n  (bsc#1262269).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266639).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,\n  CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276687).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278621).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279315).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).\n","status":"published","published":"2026-09-09T15:12:11Z","modified":"2026-09-12T18:23:08.1084477Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21835-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).\n- CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication\n  callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).\n- CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and\n  denial of service (bsc#1278624).\n- CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection\n  deadlocks and denial of service (bsc#1278624).\n","status":"published","published":"2026-09-14T13:06:15Z","modified":"2026-09-15T17:00:06.114811433Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21841-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor.tar to fix:\n\n  * bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662:\n    hauler: golang.org/x/crypto/ssh: authentication bypass and\n    deadlocks in the crypto/ssh library\n\n- update vendor.tar to fix:\n\n  * bsc#1279416, CVE-2026-84304\n  * bsc#1279296, CVE-2026-84303\n  * bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via\n    crash due to missing ':authority' and 'Host' headers\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888).\n","status":"published","published":"2026-09-14T13:24:33Z","modified":"2026-09-15T17:00:06.103421664Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21846-1","title":"Security update for keybase-client","description":"This update for keybase-client fixes the following issues:\n\nChanges in keybase-client:\n\n- CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library\n  * Add update-go-crypto.patch to update affected dependency (bsc#1278586).\n- Update to go 1.26 as required to update go crypto library\n","status":"published","published":"2026-09-14T14:01:46Z","modified":"2026-09-15T17:00:06.116639615Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21861-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\nUpdate to version 2.100.0, fixing two deadlock issues in the vendored\ngolang.org/x/crypto/ssh library reachable via crafted SSH channel\nmessages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):\n  \n* Fix gh api telemetry disablement\n* Bump go-gh to v2.16.0\n* Expose per-host API host config\n* chore: bump toolchain to go1.26.8\n* chore: bump golang.org/x/crypto to 0.56.0\n* Record attachment invocation telemetry\n* Add webhook as an official extension\n* Merge pull request #14318 from cli/issue-triage-improvements\n* Refine GHES support wording\n* Use version-neutral GHES support link\n* Clarify supported GHES versions\n* Bump go-gh to v2.15.0\n* Remove redundant searcher comment\n* Remove unnecessary 204 on release edit\n* Remove redundant comment in gist create\n* Comment api command api_host usage\n* Comment missing api-client-rollout todo\n* Document when telemetry disabling is overzealous\n* Refactor AddAuthTokenHeader\n* Rename tokenGetter to config\n* build(deps): bump go-gh to rebased per-host api_host branch\n* refactor(attachments): send uploads through api.Client.DoRequest\n* test(internal/attachments): add new method required by interface\n* fix(api): compare request hostname without port when attaching auth token\n* test(acceptance): fix scriptfilter table field alignment\n* build(deps): bump go-gh to per-host api_host branch\n* chore(codeql): cover api.Client.Request in SafeURL path query\n* fix(auth/shared): route GetScopes path through safeurl\n* test(config): add coverage for APIHostForHost\n* test(config): cover deterministic api_host collision resolution\n* test(api): assert DoRequest preserves an explicit ContentLength\n* test(acceptance): cover selecting multiple scripts in one directory\n* refactor(api): use errors.AsType for HTTP error checks\n* fix(config): resolve api_host collisions deterministically\n* docs(api): clarify redirect method-rewriting in comments\n* Send release asset uploads and downloads through api.Client\n* Let callers set headers on a shared client request\n* Let a caller stop a request following redirects\n* Let a caller name the scopes an endpoint needs\n* Add a raw response request surface to api.Client\n* Send RenameRepo to a relative path\n* Make gh api honour api_host for relative paths\n* Send a host's token to its configured api_host\n* Add the api_host gateway harness\n* Let GH_ACCEPTANCE_SCRIPT name several scripts\n* Wait longer for the search index in the issues script\n* Add acceptance coverage for gist\n* Fix discussion acceptance test flags\n* Resolve aliases to their target when rendering full help on error\n* Print full help on command misuse for invoking agents\n\nUpdate to version 2.99.0:\n\n* Add repeatable --attach flag to upload local images/videos to\n  issues, pull requests, and comments (max 50 files per call)\n* Add worktree checkout support to gh issue develop --checkout\n  --worktree\n* Fix repo sync to avoid corrupting a linked worktree and to\n  explain when the target branch is checked out elsewhere\n* Fix pr merge --delete-branch to safely handle linked worktrees\n* Reject --comments combined with --json on view commands\n","status":"published","published":"2026-09-15T16:45:32Z","modified":"2026-09-17T18:23:14.640672457Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21879-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.631355474Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21882-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276722).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260911.00\n * Add support for all possible SCALIBR os extractor for linux (#1052)\n * Migrate presubmits from deb11 to deb12 (#1050)\n * Bump the go_modules group across 1 directory with 3 updates (#1047)\n * Introduce E2E v2 framework and inventory tests (#1039)\n * Remove test case for asserting JSON marshal error from task_state.go (#1045)\n * security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)\n * Add Configuration for SCALIBR (#1034)\n * add CheckState and Cleanup tests (#1008)\n * Improve unit tests for osinfo/osinfo_linux.go (#1020)\n * Bump github.com/go-git/go-git/v5 (#1036)\n * Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)\n * Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)\n * authenticate cloud build to use docker registry (#1030)\n * Migrate e2e build to internal image (#1024)\n * Upgrade google.golang.org/grpc to new version. (#1023)\n * Improve unit tests for ospatch/yum_update.go (#1012)\n * Improve unit tests for ospatch/updates.go (#1011)\n * Add unit tests for config/package_resource.go PART 2 (#1005)\n * Add unit tests for config/package_resource.go PART 1 (#1003)\n * Add unit tests for policies/local.go (#1015)\n * Add unit tests for repository_resource.go (#1002)\n * Add unit tests for installrecipe.go part 2 (#993)\n * Add unit tests for scalibr.go (#1019)\n * Add unit tests for installrecipe.go part 1 (#992)\n * Add test cases for policies/recipes/recipedb.go (#989)\n * Bump golang.org/x/crypto (#1021)\n * Add unit tests for policies/recipes/steps.go PART 3 (#976)\n * Add unit tests for policies/recipes/steps.go PART 2 (#975)\n * Bump golang.org/x/net (#1017)\n * upgrade x/net package. (#1018)\n * Add test cases for config/file_resource.go (#988)\n * Add unit tests for policies/recipes/artifacts.go (#985)\n * Add unit tests for policies/recipes/steps.go PART 1 (#974)\n * Add tests \u0026 bugfix for packages/trace.go (#939)\n * Add unit tests for agentendpoint/agentendpoint_beta.go (#983)\n * Replace yum install with yum update (#1009)\n * Bump github.com/containerd/containerd (#1013)\n * Add unit tests for policies/apt.go PART 2 (#957)\n * Add test cases for agentendpoint/task_state.go (#984)\n * Remove deprecated rhel-sap images and add new ones (#1007)\n * Add test cases for clog/clog.go (#986)\n","status":"published","published":"2026-09-19T22:39:23Z","modified":"2026-09-25T18:23:10.631636068Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21884-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues:\n\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278681).\n- CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).\n- CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage\n  (bsc#1276994).\n\nChanges for amazon-ssm-agent:\n\n- Update to version 3.3.5390.0\n * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3\n * Bump golang.org/x/crypto from v0.53.0 to v0.56.0\n * Bump golang.org/x/net from v0.56.0 to v0.57.0\n * Bump golang.org/x/sys from v0.46.0 to v0.47.0\n * Upgrade GoLang version from 1.25 to 1.26\n * Mint control-channel token after dial to fix AZ-fault token expiry\n * Resume patch documents interrupted by an external shutdown\n * Use systemctl for systemd in aws: configureDocker on Amazon Linux\n * Update greengrass component version to 1.3.5\n\n- Update to version 3.3.5226.0\n * Add bounds check for HeaderLength in AgentMessage Deserialize\n * Bump github.com/go-git/go-git/v5 to v5.19.2\n * Bump golang.org/x/sync to v0.21.0\n * Detect Azure Linux and potential future unregistered Linux platforms\n * Fix Windows session command parsing by removing shlex\n * Fix shell injection in Windows domainjoin plugin parameters\n * Prevent control channel deadlock on ProcessorBufferFull\n * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change\n * Update the logic for loading RegistrationInfo\n * Upgrade Go version to 1.25.13\n\n- Update to version 3.3.5068.0\n\n * Migrate from aws-sdk-go v1 to aws-sdk-go-v2\n * Fix flaky registration/connection channel tests\n * Sync AWS SDK fork in extra/ with multicloud vendor changes\n * Harden function create file with permissions in a single syscall\n * Upgrade Go version to 1.25.12\n * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0\n * Fix loopback bypass in remote-host port forwarding denylist\n\n- Update to version 3.3.4851.0\n\n * Add ECS/EKS credential endpoints and loopback to port-forward denylist\n * Canonicalize IP addresses before port-forwarding denylist check\n * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin\n instead of the -w flag\n * Fix false StuckAtInProgress timeout for associations with rate \u003e= 2h\n * Fix non-interactive session big file transfer issues\n * Prevent ssm-user race condition with flock-based serialization\n * Send AWS::EC2::Instance as source type when registered with provider EC2\n * Validate process name in orphan worker detection\n\n- Update to version 3.3.4793.0\n\n * Add multicloud support enabling SSM Agent registration with\n Azure cloud providers\n * Add support for the upcoming public key in the agent code\n","status":"published","published":"2026-09-20T03:28:14Z","modified":"2026-09-25T18:23:10.832163688Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21924-1","title":"Security update for cloudflared","description":"This update for cloudflared fixes the following issues:\n\nChanges in cloudflared:\n\n- Update version to 2026.9.1\n  * Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)\n  * Propagate edge registration errors over QUIC and fix supervisor error\n    classification\n  * Negotiate protected mode during Quick Tunnel provisioning\n","status":"published","published":"2026-09-21T14:05:15Z","modified":"2026-09-25T18:23:13.337415435Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21927-1","title":"Security update for apptainer","description":"This update for apptainer fixes the following issues:\n\nChanges in apptainer:\n\n- Fix potential authentication bypass and deadlocks in the\n  crypto/ssh library by updating golang.org/x/crypto to v0.56.0.\n  CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)\n- Fix\n  * a potential DoS via crash due to missing ':authority' and\n    'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),\n  * a potential heap memory exhaustion via HTTP/2 DATA frame\n     fragmentation CVE-2026-84304 (bsc#1279236),\n  * a potential bypass of authorization policies via mixed-case\n    or canonical-case header matches due to an xDS RBAC HTTP filter\n    implementation issue CVE-2026-84303 (bsc#1279333)\n  by updating google.golang.org/grpc to v1.83.2\n","status":"published","published":"2026-09-21T13:53:22Z","modified":"2026-09-25T18:23:13.330991497Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21983-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.792813938Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21999-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.75.1: (boo#1279548)\n  - Security\n    - archive\n      - Fix zip slip path traversal in untrusted zip files\n        GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)\n      - Hide any archive entry which escapes the directory being\n        listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Reject unsafe entry names when mounting squashfs images\n        GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Fix zip subdirectory root matching sibling directories\n        GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Fix zip entry named \".\" hiding every other file\n        GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Fix \"directory not found\" for archive paths containing \"./\"\n        or \"//\" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n    - build\n      - Fix multiple CVEs by upgrading to go1.26.6 (Nick\n        Craig-Wood)\n        - CVE-2026-56860: net/url: quadratic complexity in\n          resolvePath\n        - CVE-2026-56858: html/template: JavaScript regexp context\n          tracking\n        - CVE-2026-56862: crypto/tls: limit handshake messages\n          accepted post-handshake\n        - CVE-2026-56853: net/http: apply ReadHeaderTimeout to\n          unencrypted HTTP/2 check\n        - CVE-2026-56859: encoding/xml: recursion depth guard\n          during decode\n        - CVE-2026-33818: encoding/asn1: enforce maximum recursion\n          depth\n        - CVE-2026-46600: net: panic parsing an invalid SVCB or\n          HTTPS RR in dnsmessage\n        - CVE-2026-39821: net/http: reject ASCII-only\n          Punycode-encoded labels in idna\n      - Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs\n        (Nick Craig-Wood)\n        - CVE-2026-56854: ssh: source-address critical option not\n          enforced for non-public-key auth callbacks\n        - CVE-2026-78662: ssh: a malicious peer could flood an\n          undecided channel's incoming requests, deadlocking the\n          connection\n        - CVE-2026-56855: ssh: a malicious peer could send crafted\n          messages on an established channel, deadlocking the\n          connection\n      - Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603\n        (Nick Craig-Wood)\n        - CVE-2026-46603: excessive memory allocation during VP8L\n          decoding\n      - fs: Confine directory listing entries that escape the root\n        GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick\n        Craig-Wood)\n      - fshttp: Don't send --header values to other hosts on\n        redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)\n      - http: Don't leak configured headers to other hosts or over\n        plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick\n        Craig-Wood)\n      - lib/rest: Check HTTPS downgrades against the original\n        request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick\n        Craig-Wood)\n      - local\n        - Fix dir metadata escaping the root through a planted\n          symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)\n        - Fix btime escaping the root via a planted symlink\n          GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)\n        - Fix panic on Range request past the end of a symlink\n          GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)\n      - serve docker\n        - Reject volume names that escape the base directory\n          GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)\n        - Reject volume names resolving to the base directory\n          itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)\n        - Re-derive volume mountpoint from name when restoring\n          state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)\n      - serve ftp: Fix auth-proxy sessions sharing credentials by\n        username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)\n      - serve s3\n        - Fix memory exhaustion from client-declared multipart part\n          size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)\n        - Reject bogus multipart part sizes in the reorder buffer\n          GHSA-2p48-j3qc-rx9f (Nick Craig-Wood)\n        - Fix auth proxy accepting any request signed with an empty\n          secret GHSA-xwwr-4h3p-r22c CVE-PENDING (Nick Craig-Wood)\n        - NB the auth proxy protocol for serve s3 has changed - the\n          proxy program is now given the access key ID as user and\n          must return the secret as _secret_access_key\n        - Fix each server accepting the --auth-key credentials of\n          all the others (Nick Craig-Wood)\n        - Fix misleading anonymous access log when using an auth\n          proxy via rc GHSA-p569-5gjg-9cmj CVE-PENDING (Nick\n          Craig-Wood)\n      - serve sftp: Fix auth proxy configured via rc being silently\n        ignored GHSA-p569-5gjg-9cmj CVE-PENDING (Nick Craig-Wood)\n  - Bug Fixes\n    - accounting\n      - Fix memory leak on long-running rcd (nielash)\n      - Fix memory leak from stats groups on long-running rcd\n        (nielash)\n      - Fix bwlimit burst overflow (Rayan Salhab)\n    - bisync\n      - Fix memory leak when running via the rc (nielash)\n      - Fix failed transfers of empty files being recorded as\n        synced (Nick Craig-Wood)\n    - build: Make go1.26 the minimum required version as needed by\n      golang.org/x/crypto v0.56.0 (Nick Craig-Wood)\n    - config: Redact env var config values in logs (Pastalikek65)\n    - doc fixes (Anton Karpov, CAOShurong, Dean Chen, Nick\n      Craig-Wood, Recoordinate, Rodrigo Rodrigues, Shantanav\n      Mukherjee, shaurya)\n    - lib/batcher: Prevent commits racing shutdown (Loi Nguyen)\n    - lib/transform: Fix panic in truncate_keep_extension (VXNCXNX)\n    - multipart: Fix chunked uploads storing truncated objects when\n      the source ends early (Nick Craig-Wood)\n    - operations: Fix silent truncation of streaming uploads whose\n      source ends early (Nick Craig-Wood)\n    - serve\n      - Fix VFS instance leaks on server startup failures and\n        shutdown (Hakan İSMAİL)\n      - Pass the client IP address to the auth proxy\n        (am-at-enrollvb)\n    - serve http: Prevent scrolling to the top on page reload (Sune\n      Mølgaard)\n    - serve nfs: Fix EIO when creating symlinks with --vfs-links\n      (SillyZir)\n    - serve s3\n      - Fix failed uploads deleting or corrupting the object at the\n        key (Nick Craig-Wood)\n      - Fix crash when a multipart upload is aborted while a part\n        is uploading (Nick Craig-Wood)\n      - Fix modtime not being set when only mtime metadata is\n        supplied on PUT (Nick Craig-Wood)\n      - Upload all multipart uploads via the VFS so they obey\n        --bwlimit and show in stats (Nick Craig-Wood)\n      - Reserve the .rclone_temp_ prefix for temporary objects\n        (Nick Craig-Wood)\n      - Clean up abandoned multipart uploads after\n        --multipart-expiry (Nick Craig-Wood)\n    - vfscache\n      - Fix reader deadlock when the item size drops below the read\n        offset (Dave)\n      - Fix log message growing without bound on repeated write\n        errors (Vijay Misal)\n    - walk: Stop directory traversal when the context is cancelled\n      (Rahman Yilmaz)\n  - VFS\n    - Synchronize poll updates with shutdown (Loi Nguyen)\n    - Make poll shutdown lifecycle deterministic (Loi Nguyen)\n  - Crypt\n    - Fix hash mismatches with no_data_encryption on backends which\n      check upload hashes (Nick Craig-Wood)\n    - Fix directory names which look like versioned file names\n      (TowyTowy)\n    - Warn about directories with legacy version-like encrypted\n      names (Nick Craig-Wood)\n  - Azure Blob\n    - Fix Entra ID server-side copy source authentication (Edward\n      Klesel)\n    - Fix spurious vfs cache corruption errors during chunked reads\n      (Nick Craig-Wood)\n  - Azurefiles\n    - Fix zero padded files being created when the source ends\n      early (Nick Craig-Wood)\n  - Box\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Rohit Behera)\n  - Compress\n    - Fix corrupted objects being created when the source ends\n      early (Nick Craig-Wood)\n  - Drive\n    - Don't list trashed files when removing a directory into the\n      trash (alliasgher)\n  - Dropbox\n    - Preserve Paper export paths on lookup (Loi Nguyen)\n    - Fix context cancellation (e.g. --max-duration limit) not\n      stopping in-flight requests (debaditya)\n    - Fix chunked uploads of truncated files never finishing (Nick\n      Craig-Wood)\n    - Don't retry chunked upload requests when the upload has been\n      cancelled (Nick Craig-Wood)\n    - Decode received shared-file names (Sanjay Kanth A)\n    - Fix ChangeNotify when the root's case differs from Dropbox's\n      (Loi Nguyen)\n  - Filelu\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Nick Craig-Wood)\n    - Fix duplicate root path during multipart folder creation\n      (kingston125)\n  - Huaweidrive\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Rohit Behera)\n  - Iclouddrive\n    - Fix uploads into an app container failing with 412 (Christian\n      De Santis)\n  - Internetarchive\n    - Fix corrupted files being created when the source ends early\n      (Nick Craig-Wood)\n  - Internxt\n    - Persist rotated token returned by the user info call\n      (0rangeSeaW0lf)\n  - Onedrive\n    - Fix 403 Forbidden for configuration personal onedrive\n      (machsix)\n    - Fall back to manual drive ID entry when drive listing fails\n      (SillyZir)\n    - Don't retry multipart upload chunk on 404 (upload session not\n      found) (water)\n  - Overview\n    - Fix \"internal error: no overview data found\" on 32 bit\n      architectures (Nick Craig-Wood)\n  - Pikpak\n    - Fix truncated files being created when the source ends early\n      (Nick Craig-Wood)\n    - Fix truncated single part uploads reported as ok when source\n      ends early (Nick Craig-Wood)\n  - Protondrive\n    - Fix files uploaded with v1.75.0 not being readable in the\n      Proton apps (Nick Craig-Wood)\n    - Fix corrupted uploads after a retried upload error (Nick\n      Craig-Wood)\n  - Quatrix\n    - Fix chunk upload retries and fix memory leak (Nick\n      Craig-Wood)\n  - S3\n    - Update Mega endpoints (Nick Craig-Wood)\n    - Treat UploadPart success without ETag as retryable error\n      (CAOShurong)\n    - Fix server side copy failing with --s3-no-head-object\n      (Anatoly Tarnavsky)\n  - Sia\n    - Fix corrupted files being created when the source ends early\n      (Nick Craig-Wood)\n  - Smb\n    - Reuse the upload connection for SetModTime (alliasgher)\n  - WebDAV\n    - Fix SetModTime failing and hashes missing on Nextcloud (Nick\n      Craig-Wood)\n  - Yandex\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Rohit Behera)\n\n- Update to version 1.75.0:\n  - New S3 Providers\n    - Scality (RING / ARTESCA)\n    - Zero Services (ZERO-Z3)\n  - Security\n    - archive: Don't crash on malformed squashfs images\n      GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)\n    - ftp: Fix ftp command injection when encoding doesn't include\n      CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)\n    - lib/http: Use TLS on all --addr listeners when --cert and\n      --key are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)\n    - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM\n      GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)\n    - local: Stop source file names escaping the destination\n      directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)\n    - rc\n      - Don't expose pprof debug handlers on an unauthenticated\n        server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)\n      - Require authentication to list the remotes with --rc-serve\n        GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)\n      - Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv\n        (Nick Craig-Wood)\n    - s3\n      - Fix redirect credential leaks, reject HTTPS-\u003eHTTP and strip\n        secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)\n      - Strip S3 Express session token on cross-host redirects\n        GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)\n      - serve ftp: Use constant time comparison for password check\n        GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)\n      - serve restic: Fix path traversal above the served directory\n        GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)\n      - serve sftp: Don't crash the whole server on a bad request\n        GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)\n      - sftp: Fix command injection via crafted filenames on\n        PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick\n        Craig-Wood)\n      - vfs: Don't crash the process if a backend panics on a\n        background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)\n    - webdav\n      - Fix HTTPS to HTTP redirects leaking credentials\n        GHSA-h4mf-4v27-hggj (Nick Craig-Wood)\n      - Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv\n        (Nick Craig-Wood)\n    - Update google.golang.org/grpc to fix multiple security\n      problems (Nick Craig-Wood)\n  - New Features\n    - build: Update all dependencies (Nick Craig-Wood)\n    - config\n      - Add config unset command to remove options from a remote\n        (Nick Craig-Wood)\n      - Add tier to config wizard (dougal)\n    - docker serve\n      - Add timeout to volume restore so slow remotes don't block\n        startup (Nick Craig-Wood)\n      - Restore volumes concurrently so one slow remote doesn't\n        block others (Nick Craig-Wood)\n      - Make Create idempotent to avoid \"volume already exists\"\n        after restart (Nick Craig-Wood)\n    - doc fixes (blackflytech, dougal, Giridhar, KTibow,\n      mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren\n      Lindberg, yashanil98)\n    - filter\n      - Support nested {} alternates in glob filters (maximilize)\n      - Add --files-from0 to support NUL-delimited input (Gaurav)\n    - fserrors: Make http2 \"server sent GOAWAY\" a retriable error\n      (phatlc)\n    - fshttp\n      - Add --dump errors to dump only failed HTTP transactions\n        (Nick Craig-Wood)\n      - Add --dump trace to log connection level events via\n        httptrace (Nick Craig-Wood)\n    - gui\n      - Serve static files with gzip/deflate compression (Leon\n        Brocard)\n      - Respect explicit --rc-allow-origin instead of always\n        deriving it from the bind address (Kyue)\n      - Update embedded release to 1.1.11 (Nick Craig-Wood)\n    - mount2: Add --allow-idmap to advertise FUSE_ALLOW_IDMAP\n      (Valerij Fredriksen)\n    - nfsmount: Call mount_nfs directly on OpenBSD so -T is\n      accepted (Socialpranker)\n    - rc\n      - Respond with 202 if prefer-async header is passed (FTCHD)\n      - Add config/oauthstop and config/oauthstatus to control\n        oauth listener (FTCHD)\n      - Include OAuth authorization URL in rc config/oauthstatus\n        response (Hakan İSMAİL)\n      - Allow setting rc config and filter options as flat\n        parameters (Hakan İSMAİL)\n    - serve\n      - Support custom http response headers (kkocdko)\n      - Update serve remote control to accept nested as well as\n        flat options (Hakan İSMAİL)\n    - serve dlna: Bound SOAP request bodies (Acts1631)\n    - serve nfs\n      - Allow NFS clients to mount subpaths of the served remote\n        (Nick Craig-Wood)\n      - Advertise AUTH_UNIX so the *BSD NFS clients can mount\n        (Socialpranker)\n    - serve s3: Stream multipart uploads to the backend instead of\n      buffering in memory (Nick Craig-Wood)\n    - serve sftp\n      - Implement statvfs@openssh.com to report disk usage (Nick\n        Craig-Wood)\n      - Use the requested atime when setting file times (Nick\n        Craig-Wood)\n    - serve webdav: Add gzip compression for compressible responses\n      (Leon Brocard)\n    - serve http: Add --disable-dir-list flag (Leon Brocard)\n  - Bug Fixes\n    - archive/squashfs: Fix reading images with no fragment or\n      xattr table (maximilize)\n    - chunkedreader: Fix spurious errors when a parallel stream is\n      closed early (Nick Craig-Wood)\n    - config\n      - Fix config_template_file and config_template being ignored\n        via config/create (hexbinoct)\n      - Fix normalization when obscuring passwords (Nick\n        Craig-Wood)\n    - docker serve: Fix plugin timeout on restart when volumes have\n      active mounts (Nick Craig-Wood)\n    - fs: Fix passwords and tokens appearing in the debug log\n      during rclone config (Nick Craig-Wood)\n    - gui: Fix cross-origin API requests when bound to a wildcard\n      address (FTCHD)\n    - hash: Fix xxh128 hasher size (Yuhang Cao)\n    - log: Fix side effects when importing rclone as a library\n      (Sven Rebhan)\n    - march\n      - Fix unnecessarily listing dst directory when src listing\n        finished (Nick Craig-Wood)\n      - Fix goroutine leak on completed async rc jobs (Yash Anil)\n    - nfsmount: Fix mount_nfs options incompatible with OpenBSD\n      (Socialpranker)\n    - rc\n      - Fix operations/stat for directories with large parent dirs\n        (Nick Craig-Wood)\n      - Fix _filter and _config parameters being ignored by mount/*\n        commands (Hakan İSMAİL)\n    - serve: Fix auth proxy using stale config parameters when\n      making a backend (Nick Craig-Wood)\n    - serve s3\n      - Fix aborted multipart uploads appearing as ghosts (Nick\n        Craig-Wood)\n      - Fix streamed multipart uploads not being atomic (Nick\n        Craig-Wood)\n      - Fix OOM and InvalidPart errors with concurrent multipart\n        uploads (Nick Craig-Wood)\n    - sync: Fix --fix-case rename on backends that need upload\n      before overwrite (Nick Craig-Wood)\n    - Mount\n      - Support flat VFS and Mount options in mount RC command\n        (Hakan İSMAİL)\n    - VFS\n      - Fix IO error by recreating the cache file if it has been\n        removed (Nick Craig-Wood)\n      - Fix \"invalid seek position\" error when cache files larger\n        than the remote (Nick Craig-Wood)\n      - Fix vfs cache writeback timer not being stopped when\n        --transfers reached (Nick Craig-Wood)\n      - Fix crash when multiple mounts or servers share the same\n        VFS (Nick Craig-Wood)\n    - Local\n      - Add --local-fatal-if-no-space flag (ferrumclaudepilgrim)\n      - Don't resolve relative roots to absolute paths (Nick\n        Craig-Wood)\n    - Archive\n      - Fix squashfs listings failing with invalid argument after\n        update (Nick Craig-Wood)\n    - Azure Blob\n      - Fix MD5 being dropped on range reads causing vfs cache\n        re-downloads (Nick Craig-Wood)\n      - Add use_arrow_list flag for experimental Apache Arrow\n        listing (Nick Craig-Wood)\n      - List very large containers in parallel with\n        list_parallelism (Nick Craig-Wood)\n    - Azurefiles\n      - Fix incorrect modtime after uploading a file or setting its\n        modtime (Nick Craig-Wood)\n      - Improve modtime precision from 1s to 100ns (Nick\n        Craig-Wood)\n    - Combine\n      - Don't return an error message as the remote name for a bad\n        object (Nick Craig-Wood)\n    - Drime\n      - Remove stale mux_status field from Item (Nick Craig-Wood)\n    - Drive\n      - Warn in config wizard before using the shared client_id\n        (Nick Craig-Wood)\n      - Detect shortcut loops to avoid infinite recursion (Nick\n        Craig-Wood)\n    - Dropbox\n      - Add support for impersonate_admin (Gaurav)\n      - Add --dropbox-skip-shared-folders and\n        --dropbox-skip-unowned-folders (Gaurav)\n      - Make Rmdir use one less API call (Socialpranker)\n      - Use much less memory when uploading small files (Nick\n        Craig-Wood)\n      - Remove an unnecessary API call when uploading small files\n        (Nick Craig-Wood)\n    - Filen\n      - Fix incorrect modtime after updating a file or setting its\n        modtime (Nick Craig-Wood)\n    - Filescom\n      - Fix missing MD5 hash after uploading a file (Nick\n        Craig-Wood)\n    - FTP\n      - Fix incorrect modtime after uploading a file or setting its\n        modtime (Nick Craig-Wood)\n    - Googlephotos\n      - Warn in config wizard before using the shared client_id\n        (Nick Craig-Wood)\n    - Hasher\n      - Fix Update not storing hashes in bolt DB after file\n        replacement (Nick Craig-Wood)\n    - Hdfs\n      - Fix incorrect modtime after uploading a file or setting its\n        modtime (Nick Craig-Wood)\n    - Hidrive\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n    - HTTP\n      - Don't list parent directory when pointing at a single file\n        (Nick Craig-Wood)\n      - Add Prefer to CORS Access-Control-Allow-Headers header\n        (sijie-Z)\n    - Iclouddrive\n      - Fix \"cannot unmarshal number\" error when listing photo\n        albums (Nick Craig-Wood)\n      - Fix 2FA failing with 409 even when the code is valid (Punya\n        Jain)\n    - Imagekit\n      - Fix Open with a RangeOption returning the wrong data (Nick\n        Craig-Wood)\n      - Add mtime to the available metadata (Nick Craig-Wood)\n    - Internxt\n      - Add Move and DirMove methods for server-side file and\n        directory operations (jzunigax2)\n      - Handle file size limit errors during uploads (jzunigax2)\n      - Surface re-login error when re-auth fails in NewFs\n        (0rangeSeaW0lf)\n    - Jottacloud\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n    - Linkbox\n      - Retry bot protection HTML challenge responses instead of\n        failing (Nick Craig-Wood)\n    - Mailru\n      - Fix incorrect modtime after updating a file or setting its\n        modtime (Nick Craig-Wood)\n    - Mega\n      - Fix files reappearing in listings after being renamed (Nick\n        Craig-Wood)\n      - Fix moved files disappearing from listings between remotes\n        (Nick Craig-Wood)\n    - Netstorage\n      - Fix missing MD5 hash after uploading a file (Nick\n        Craig-Wood)\n    - Onedrive\n      - Add support for no admin mode (TaterLi)\n      - Treat non-2xx preauth download as error (ifloppy)\n      - Download malware-flagged files via Graph Prefer header\n        (ifloppy)\n    - Opendrive\n      - Fix uploaded objects returning the wrong hash and modtime\n        (Nick Craig-Wood)\n    - Oracleobjectstorage\n      - Fix crash when downloading objects with unknown length\n        (Nick Craig-Wood)\n      - Add --oos-decompress flag to download gzip-encoded files\n        (Nick Craig-Wood)\n    - Pixeldrain\n      - Fix incorrect modtime and missing hash after uploading a\n        file (Nick Craig-Wood)\n    - Protondrive\n      - Implement proper retry logic (tomholford)\n      - Fix gopenpgp: invalid data: user ID signature with wrong\n        type on custom-domain account (Nick Craig-Wood)\n      - Fix long hangs on permanent validation failures (Nick\n        Craig-Wood)\n      - Fix incorrect modtime after uploading a file (Nick\n        Craig-Wood)\n    - Putio\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n      - Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT\n        errors (Nick Craig-Wood)\n    - Quatrix\n      - Fix incorrect modtime after uploading a file (Nick\n        Craig-Wood)\n    - S3\n      - Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)\n      - Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)\n    - Seafile\n      - Fix rclone sync files with identical size again and again\n        (TowyTowy)\n    - SFTP\n      - Add --sftp-pin-host-key - Trust On First Use host key\n        pinning (Nick Craig-Wood)\n      - Add --sftp-encoding support (Puneet Dixit)\n      - Don't retry permanent connection errors (Nick Craig-Wood)\n      - Allow silencing no hostkey validation warning (Noah Zalev)\n      - Fix cmd shell execution of paths containing\n        variable-expansion or newline characters (Nick Craig-Wood)\n    - Shade\n      - Retry server errors instead of failing the transfer (Nick\n        Craig-Wood)\n      - Fix uploads failing with EOF when completing multipart\n        uploads (Nick Craig-Wood)\n    - Smb\n      - Fix Kerberos credentials being reloaded for every\n        connection (Nick Craig-Wood)\n      - Fix TCP connection leak when connection setup fails (Nick\n        Craig-Wood)\n      - Fix server-side move of directories with special characters\n        in the name (Nick Craig-Wood)\n      - Fix spurious \"Directory already exists\" errors when moving\n        directories (Nick Craig-Wood)\n    - Ulozto\n      - Fix server side moves between differently rooted remotes\n        losing files (Nick Craig-Wood)\n    - WebDAV\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n    - Yandex\n      - Fix 500 errors by waiting for uploads to complete before\n        setting modtime (Nick Craig-Wood)\n      - Fix missing MD5 hash after uploading a file (Nick\n        Craig-Wood)\n      - Fix modtime randomly reverting to the upload time after\n        upload (Nick Craig-Wood)\n      - Add --yandex-upload-wait to fix 500 errors when uploading\n        (Nick Craig-Wood)\n    - Zoho\n      - Honour Retry-After header on 429 (Erol Ozcan)\n      - Add --zoho-tpslimit and --zoho-tpslimit-burst (Erol Ozcan)\n      - Log throttling once per episode at NOTICE (Erol Ozcan)\n      - Rate limit repeated listings of the same folder (Erol\n        Ozcan)\n      - Fix flaky folder list limiter test under concurrent\n        listings (Nick Craig-Wood)\n      - Fix large file overwrite creating a duplicate instead of\n        replacing (Erol Ozcan)\n      - Treat R008 unauthorized as directory not found (Erol Ozcan)\n      - Preserve root_folder_id on reconnect and allow setting it\n        (Erol Ozcan)\n","status":"published","published":"2026-09-28T15:31:12Z","modified":"2026-10-01T18:23:12.143628024Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:15:27Z","modified":"2026-10-09T17:23:14.415693669Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22064-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278614).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).\n- Verification bypass via public key in legacy bundle (bsc#1282542).\n\nChanges for cosign:\n\n- update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):\n * This release resolves GHSA-fx35-mq7g-6g98, a verification\n bypass using an unexpected public key in a legacy bundle.\n * Auto-detect default digest algorithm for public keys\n * fix(pkcs11key): return an error instead of panicking when no\n key pair matches\n * Supporting OCI Signing with X.509 Certificate Chain\n * test(inspect): replace mock TSA client usage with local\n timestamp response generator in\n * fix: prevent shell completions for various options not taking\n filenames\n * fix(blob): compare file checksums case-insensitively in\n * Verification bypass via public key in legacy bundle (GHSA-\n fx35-mq7g-6g98)\n","status":"published","published":"2026-10-09T06:33:57Z","modified":"2026-10-19T17:23:11.640294525Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23692-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:28:52Z","modified":"2026-09-29T18:23:12.31116925Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23712-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:28:52Z","modified":"2026-09-29T18:23:12.805639295Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23736-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-14T09:33:48Z","modified":"2026-09-27T18:23:09.684187591Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23739-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260908.00\n","status":"published","published":"2026-09-15T06:54:33Z","modified":"2026-09-27T18:23:09.724146769Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23745-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260264).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n","status":"published","published":"2026-09-17T07:24:14Z","modified":"2026-09-27T18:23:10.770303667Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23831-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-14T09:47:52Z","modified":"2026-09-27T18:23:14.42755251Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23841-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issue:\n\n- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n","status":"published","published":"2026-09-15T07:07:31Z","modified":"2026-09-27T18:23:15.336463615Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23874-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260264).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n","status":"published","published":"2026-09-17T08:06:49Z","modified":"2026-09-28T18:23:12.4512778Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23876-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276722).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260911.00\n * Add support for all possible SCALIBR os extractor for linux (#1052)\n","status":"published","published":"2026-09-18T09:19:49Z","modified":"2026-09-28T18:23:12.568364241Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23924-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276722).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260911.00\n * Add support for all possible SCALIBR os extractor for linux (#1052)\n","status":"published","published":"2026-09-18T07:08:56Z","modified":"2026-09-30T18:23:13.125438948Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23973-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:08.92538367Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23984-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:09.062210416Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24148-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:07:44Z","modified":"2026-10-16T17:23:10.706600173Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24213-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278614).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).\n- Verification bypass via public key in legacy bundle (bsc#1282542).\n\nChanges for cosign:\n\n- update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):\n * This release resolves GHSA-fx35-mq7g-6g98, a verification\n bypass using an unexpected public key in a legacy bundle.\n * Auto-detect default digest algorithm for public keys\n * fix(pkcs11key): return an error instead of panicking when no\n key pair matches\n * Supporting OCI Signing with X.509 Certificate Chain\n * test(inspect): replace mock TSA client usage with local\n timestamp response generator in\n * fix: prevent shell completions for various options not taking\n filenames\n * fix(blob): compare file checksums case-insensitively in\n * Verification bypass via public key in legacy bundle (GHSA-\n fx35-mq7g-6g98)\n","status":"published","published":"2026-10-09T06:33:43Z","modified":"2026-10-21T17:23:10.146441225Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283642).\n- CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n\nChanges for helm:\n\n- update to 4.3.0:\n * feat: Add duration functions\n * feat(engine): add debug logging when lookup returns empty\n * feat: add ownership verification before deleting resources\n * feat: honor SOURCE_DATE_EPOCH for chart archives\n * feat(rollback): add --description flag to provide rollback\n reason\n * fix (internal/plugin): remove zero-width spaces from plugin\n name comment\n * fix(loader): do not drop values files ending at a 4096-byte\n boundary\n * fix(chart): normalize StampModTimes timestamp to UTC/truncate\n + Chart.lock reproducibility test\n * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings\n * fix(template): regression - route registry messages to stderr\n in template and show\n * refactor: lower resync period from one hour to 3 minutes\n * perf: enable concurrent status computation to prevent\n multi-minute delays\n * fix: Improve error reporting for helm template --debug with\n --show-only- #31185\n * fix: fetch logs from all containers in test pods- #32099\n * fix(provenance): check error return in Digest and\n encodeRelease- #32136\n * fix panic on repeated IsReachable calls- #32184\n * fix: set [pull,push] scope when helm push to a registry(use\n token auth) - v4- #31211\n * Fix missing conflict retry with server-side apply- #32088\n * Properly format the extra field in gzipped packages- #31884\n * Fix vanishing empty lines- #32327\n * fix: pass registry client to downloader.Manager in upgrade-\n #32400\n * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1-\n #32450\n * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158-\n #32521\n * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0\n 43e8b7f (Terry Howe)\n * bump golang.org/x/text to v.0.40.0\n * Revert: Fixed a race condition in WaitForDelete where the status\n observer canceled the watch too early, causing intermittent\n failures when running a full test suite #32214\n * Fixed data race detected by -race flag when concurrent\n goroutines (upgrade + rollback, install + uninstall) both call\n GetWaiterWithOptions on the same FailingKubeClient instance\n #31925\n * Fixed helm command success messages writing to stderr instead\n of stdout. Now correctly outputing to stdout #32056\n * Fixed Helm 4 emitting \"unable to find exact version\" when using\n version range constraints #31757\n * Fixed a race condition in WaitForDelete where the status\n failures when running a full test suite #32081\n #32153\n * Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1,\n controller-runtime 0.24.1 and k8s 1.36.1 #32128\n * Dependency updates\n * Bump to version v4.2 0646808 (George Jenkins)\n * build: Clean up Goreleaser change (#32098) e23bf3a (Scott\n Rigby)\n * fix: add -extldflags -static to dist target to match\n build-cross f60ab7c (Terry Howe)\n * build: use goreleaser build with manual archive creation\n 64aa46f (Terry Howe)\n * chore: remove build-cross dependency from test-acceptance\n d199a1a (Terry Howe)\n * ci: add fetch-depth 0 to canary checkout for goreleaser 8289940\n * fix: address goreleaser build issues flagged in review c075022\n (Terry Howe)\n * fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve\n v-prefix in archive names 04885dd (Terry Howe)\n * fix: disable goreleaser checksums.txt and restrict zip to\n windows only 93103ce (Terry Howe)\n * fix: use index for optional env var in version_template e49a1dc\n * fix: canary build file names eaa0910 (Terry Howe)\n * Fix archive name 5a75279 (Terry Howe)\n * fix goreleaser archive 37284a9 (Terry Howe)\n * add support for loong64 45336cc (Terry Howe)\n * fix artifact directory a9659b0 (Terry Howe)\n * update configuration to v2 e368f17 (Terry Howe)\n * remove GOTOOLCHAIN e7bea85 (Terry Howe)\n * chore: replace mitchellh/gox with goreleaser 075c096 (Terry\n Howe)\n * chore(deps): bump github.com/distribution/distribution/v3\n 12f2c41 (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3\n 58e8ffd (dependabot[bot])\n * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0\n to 3.5.0 e61bbfb (dependabot[bot])\n * Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df\n (Matheus Pimenta)\n * fix: adds topLevel permissions to improve openSSF scores\n 277d970 (Gagan H R)\n * Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7\n * fix(templating): hooks conflicting with templates in\n post-renderers (#32049) 8f56f24 (Matheus Pimenta)\n * docs: fix grammar and spacing in CONTRIBUTING.md db40adb\n (Mohit)\n * chore(deps): bump the k8s-io group with 7 updates 775e794\n (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2\n 934ace3 (dependabot[bot])\n * fix(templating): SplitManifests must preserve line endings for\n downstream YAML parsers (#31952) 265c5eb (Matheus Pimenta)\n * chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to\n 1.0.13 48e2b7d (dependabot[bot])\n * Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai)\n * test(values): Add test for nil cleanup in partially overridden\n subchart maps 52fc971 (Johannes Lohmer)\n * fix(values): do not copy chart-default nils into coalesced\n values 0063877 (Johannes Lohmer)\n * test(values): add test for subchart nil producing %!s() 6eb4ebf\n (Johannes Lohmer)\n * test(values): add tests for subchart nil value regressions\n 5cb4e7d (Johannes Lohmer)\n * chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1\n b5c7c80 (dependabot[bot])\n * fix(templating): fix wrong YAML separator parsing for\n post-renderers (#31941) a27f1ad (Matheus Pimenta)\n * fix: add debug logging to HTTP getter for helm pull c26be60\n (Cairon)\n * chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0\n 953f5f0 (dependabot[bot])\n * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0\n 10fc5f3 (dependabot[bot])\n * chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0\n d89e7c6 (dependabot[bot])\n * chore: Update release notes script for Helm v4 8a95461 (George\n Jenkins)\n * refactor(cli): share RetryingRoundTripper via pkg/kubeenv\n 213c869 (Sumit Solanki)\n * chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3\n bd5027a (dependabot[bot])\n * fix: unnecessary-format lint issues from merge 087736b (George\n * fix: Plugin missing provenance bypass 586eb57 (George Jenkins)\n * chore(deps): bump github.com/fluxcd/cli-utils c8c5dfa\n * chore(deps): bump\n go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp\n 998466c (dependabot[bot])\n go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\n b0cec58 (dependabot[bot])\n go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n 6ebfb29 (dependabot[bot])\n * test(kube): fix flaky WaitForDelete test by avoiding informer\n sync race a7f8443 (Terry Howe)\n * test(kube): fix flaky WaitForDelete timing in status wait tests\n 4c0d21f (Terry Howe)\n 08dea9c (dependabot[bot])\n * Minor nit: fix import instructions to comply with canonical\n import paths de58531 (Anmol Virdi)\n 9b1ad4c (dependabot[bot])\n * fix(action): return correct error variable in prepareUpgrade\n 8ef2d45 (Rhys McNeill)\n * chore(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2\n cd7cf76 (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.30.7 to 4.35.1\n 45ee55b (dependabot[bot])\n * chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1\n 9a06741 (dependabot[bot])\n * chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0 d1e31ca\n * fix(kube): clarify server-side apply patch errors f257c95\n (abhay1999)\n workflow 7025480 (Terry Howe)\n * refactor(cli): decouple EnvSettings from pkg/kube 64f1d0a\n (Sumit Solanki)\n * docs(registry): fix incorrect and improve clarity of comments\n in client.go 85bf56e (Debasish Mohanty)\n * refactor(cli): decouple EnvSettings from pkg/kube to avoid\n import cycles 1549937 (Sumit Solanki)\n * chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to\n 1.4.1 c7a75b1 (dependabot[bot])\n * chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0\n 3a7573a (dependabot[bot])\n * chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0\n 0229da1 (dependabot[bot])\n * docs(engine): fix misleading toTOML doc comment c1a5a6e (Ilya\n Kiselev)\n * feat(engine): add mustToToml template function b075f7a (Ilya\n * chore: fix unnecessary-format issues from revive 7edfff3\n (Matthieu MOREL)\n * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3\n 37185d2 (dependabot[bot])\n * chore: fix bool-compare issues from testifylint 071558d\n * chore: enable perfsprint linter 6249489 (Matthieu MOREL)\n * ignore error plugin loads (cli, getter) 47a0840 (George\n * chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0\n 3d06fd1 (dependabot[bot])\n * fix(kube): remove legacy import comments from test files\n e64d628 (Terry Howe)\n * pkg/kube: remove legacy import comments d7cdc9e (abhay1999)\n * fix: Plugin version path traversal 36dcc27 (George Jenkins)\n * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0\n c4be7af (dependabot[bot])\n * chore: fix some minor issues in the comments 259f181 (tsinglua)\n * fix: Chart dot-name path bug 6018499 (George Jenkins)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to\n 0.23.3 74e7cf8 (dependabot[bot])\n * fix: insert newline after doc separators glued to content by\n template trimming af94abf (Matheus Pimenta)\n * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to\n 1.6.3 16073b1 (dependabot[bot])\n * chore: enable modernize linter (#31860) e31a078 (Matthieu\n MOREL)\n * Restored --atomic flag on install command 16573f8 (Travis\n Leeden)\n * fix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for\n GO-2026-4394 b550ce9 (Terry Howe)\n * fix: bump fluxcd/cli-utils to v0.37.2-flux.1 1dfa77e (Terry\n * Update pkg/cmd/status.go 5d40f17 (Matthieu MOREL)\n * chore(internal): enable perfsprint linter (#31871) d4f6193\n * chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0\n 82d9bed (dependabot[bot])\n * chore(pkg): fix perfsprint linter issues part 6 dc0e3f1\n * chore(pkg): enable perfsprint linter e3c74fd (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 1d2d63c (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 63f03c0 (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter c25c988 (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 0fecfd0 (Matthieu MOREL)\n * chore(internal): enable perfsprint linter 6524162 (Matthieu\n * chore(pkg): enable perfsprint linter 6c2cb2f (Matthieu MOREL)\n * chore(internal): enable perfsprint linter 9409226 (Matthieu\n * Replace unneeded use of t.Fatalf with t.Fatal 36cb3a2 (Mads\n Jensen)\n * fix: enable nolinlint linter 5b6c6bb (Matthieu MOREL)\n * fixup strings.Cut variables b667317 (George Jenkins)\n * chore: Improve AGENTS.md 956c724 (George Jenkins)\n * chore: fixes 92b64e8 (George Jenkins)\n * fix: correct import comment in statuswait.go from v3 to v4\n c59c140 (rohansood10)\n * fix: handle OCI digest algorithm prefix in chart downloader\n (#31601) ee01860 (Evans Mungai)\n * chore(deps): bump actions/stale from 10.1.1 to 10.2.0 304d25f\n * chore(deps): bump the k8s-io group with 7 updates 0b13436\n * feat(release): add internal/release/v2 package for chart v3\n support (#31709) 4a91f3a (Evans Mungai)\n 7823853 (dependabot[bot])\n aec7ace (dependabot[bot])\n a23b638 (dependabot[bot])\n 5cddc95 (dependabot[bot])\n * chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.0 to\n 0.21.1 2e266c3 (dependabot[bot])\n * fix(pkg): errorlint linter 259f76a (Matthieu MOREL)\n * fix(internal): errorlint linter 0254182 (Matthieu MOREL)\n * fix(pkg): errorlint linter 6d1490e (Matthieu MOREL)\n * fix(pkg): errorlint linter 4d0ae7f (Matthieu MOREL)\n * fix(internal): errorlint linter abecafa (Matthieu MOREL)\n * fix(pkg): errorlint linter 4330bde (Matthieu MOREL)\n * fix(pkg): errorlint linter c8989d9 (Matthieu MOREL)\n * fix(cmd): errorlint linter edbd705 (Matthieu MOREL)\n * chore: new KEYS entry for George Jenkins 5638c35 (George\n * fix(downloader): safely handle concurrent file writes on\n Windows 76eb37c (Orgad Shaneh)\n * fix(install): check nil for restClientGetter and fix tests\n 9817a68 (Manuel Alonso)\n * feat(create): add --chart-api-version flag (when\n HELM_EXPERIMENTAL_CHART_V3 env var is set) (#31592) 5aac320\n (Evans Mungai)\n * chore(pkg): fix modernize linter 0d75d86 (Matthieu MOREL)\n * chore(internal): fix modernize linter 859292e (Matthieu MOREL)\n * chore(pkg): fix modernize linter 5cc2e55 (Matthieu MOREL)\n * chore(pkg): fix modernize linter ba38159 (Matthieu MOREL)\n * chore(internal): fix modernize linter e2d184c (Matthieu MOREL)\n * chore(pkg): fix modernize linter 111d4e6 (Matthieu MOREL)\n * add image index test e8f386b (Pedro Torres)\n * fix pulling charts from OCI indices d983696 (Pedro Torres)\n 9c9c3a6 (dependabot[bot])\n * Revert \"Consider GroupVersionKind when matching resources\"\n 787b61c (Matheus Pimenta)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to\n 0.23.1 becf9bf (dependabot[bot])\n * fix(template): deprecate unused --hide-notes and\n --render-subchart-notes flags 6d5f56f (Scott Rigby)\n * chore(deps): bump github.com/fluxcd/cli-utils b53198e\n * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 b59e533\n * whitespace ec07265 (Austin Abro)\n * fix(copystructure): handle nil elements in slice copying\n e3829eb (Philipp Born)\n * use logger with waiter 63b40a7 (Austin Abro)\n * feat(kstatus): fine-grained context options for waiting b0b35f1\n * Apply suggestions from code review 26e28e8 (George Jenkins)\n * Remove legacy sync-repo.sh script 97fd007 (Jeevan Yewale)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to\n 0.23.0 5262007 (dependabot[bot])\n * docs: document uninstall using cascade foreground flag e70d59d\n * bugfix(kstatus): do not wait forever on failed resources\n bbec77c (Matheus Pimenta)\n * Modernize Helm v3 CONTRIBUTING.md 443a2a6 (George Jenkins)\n * chore(defaults): server-side apply SDK defaults should always\n match the CLI defaults c1cc625 (Matheus Pimenta)\n * chore: clarify --wait flag help text 828038a (Evans Mungai)\n * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 e223771\n * chore(refactor): better testing and functionality for\n installing crd 6501ef4 (Manuel Alonso)\n * bugfix(storage): fix storage not getting logger from driver\n a8eb527 (Matheus Pimenta)\n da1d68a (dependabot[bot])\n * fix(test): fix tests and check nil for restclient 0f949a9\n (Manuel Alonso)\n * fix(test): merge fix correctly 561410a (Manuel Alonso Gonzalez)\n * Remove refactorring changes from coalesce_test.go 0298b2f\n * Fix import b8937ad (Evans Mungai)\n * Update pkg/chart/common/util/coalesce_test.go a333bba (Evans\n Mungai)\n * Fix rollback for missing resources 374aeb4 (Feruzjon\n Muyassarov)\n * fix(install): add more tests and check nil file data 00f0a48\n * fix(test): no check empty resources 0357e8d (Manuel Alonso)\n * fix(install): check lenght and file nil, add tests 52235cc\n * fix(action): crd resources can be empty 268593b (Manuel Alonso)\n * fix: casing issue fixed 1709114 (Mujib Ahasan)\n * fix: error handled correctly 9486062 (Mujib Ahasan)\n * fix: doc string added 12e8b71 (Mujib Ahasan)\n * Fix lint warning 3416dd5 (Evans Mungai)\n * Preserve nil values in chart already 679f051 (Evans Mungai)\n * fix(values): preserve nil values when chart default is empty\n map 292fe70 (Evans Mungai)\n * update: test coverage added for helper function\n validateNameAndGenerateName 1154099 (Mujib Ahasan)\n * update: helper function added for the business logic 522d2fe\n (Mujib Ahasan)\n * generateName is also considered in logic 6769fb6 (Mujib Ahasan)\n * fxi: test concurrency download index 64bae71 (Terry Howe)\n * update: business logic respected for skipping object missing\n name b357bca (Mujib Ahasan)\n * fixed: --dry-run=server now respect generateName 2820ebe (Mujib\n Ahasan)\n * Make error message instructional for the case of lock file\n being out of date 1836c59 (Andreas Sommer)\n - GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov\n is missing, allowing unsigned plugin install\n - GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version\n enables arbitrary file write outside Helm plugin directory\n - fix: Plugin missing provenance bypass 05fa379 (George\n - fix: Chart dot-name path bug 4e7994d (George Jenkins)\n - ignore error plugin loads (cli, getter) 2581943 (George\n - fix: Plugin version path traversal 36c8539 (George Jenkins)\n scorecards workflow c61e086 (Terry Howe)\n * Fixed a bug where --dry-run=server was not respecting\n generateName #31563\n * Fixed a bug where empty CRD resources caused a crash. Now it\n prints an error #31578\n * Fixed a bug where OCI references with tag+digest failed with\n \"invalid byte\" error #31601\n * Fixed a bug where user-provided nil value was not preserved\n when chart has an empty map or no default for a key #31644\n * Fixed a regression since Helm 3.18.0 where Pulling charts\n from OCI repositories that use an index to store both\n Container Images and Helm Charts under the same tag failed\n #31776\n * Fixed a Helm 4 regression where gotemplate white space\n trimming directly after YAML doc separators, when present\n after postrendering, caused YAML file corruption #31868\n * Fixed a bug where `FailedStatus` is treated as a terminal\n state, causing upgrades to fail prematurely when cluster\n autoscalers needed time to provision nodes, or when pods were\n being deleted during rolling updates #31897\n * Fixed broken backwards compatibility for deprecated\n `--atomic` flag on install command #31901\n * SDK: Fixed a Windows 'Access Deined' error if multiple\n processes try to download the same chart version concurrently\n #31128\n * SDK: Fixed a bug where users did not receive any logs from\n the waiter, causing confusion as several minutes could pass\n with no user feedback #31717\n * SDK: Fixed a bug where server-side apply defaults did not\n always match the CLI defaults #31732\n * SDK: Fixed a Go import issue when downstream tooling\n attempted to vendor helm.sh/helm/v4/pkg/kube #31852\n - Fixed a bug where --dry-run=server was not respecting\n - Fixed a bug where empty CRD resources caused a crash. Now it\n - Fixed a bug where OCI references with tag+digest failed with\n - Fixed a bug where user-provided nil value was not preserved\n - Fixed a regression since Helm 3.18.0 where Pulling charts\n - Fixed a Helm 4 regression where gotemplate white space\n - Fixed a bug where FailedStatus is treated as a terminal\n - Fixed broken backwards compatibility for deprecated --atomic\n flag on install command #31901\n - SDK: Fixed a Windows 'Access Deined' error if multiple\n - SDK: Fixed a bug where users did not receive any logs from\n - SDK: Fixed a bug where server-side apply defaults did not\n - SDK: Fixed a Go import issue when downstream tooling\n- Update to version 4.1.1:\n - fix: fine-grained context options for waiting #31735\n - fix: kstatus do not wait forever on failed resources #31730\n - fix: Revert \"Consider GroupVersionKind when matching\n resources\" #31772\n - fix: handle nil elements in slice copying #31751\n - Feature: added chart name to dependency logs, namespace to\n resource waiting logs, and confirmation message when all\n resources are ready #31530\n - Feature: improved plugin name validation error messages and\n field name detection #31491\n - Feature: improved the --wait flag by allowing explicit\n strategy selection (including explicit --wait=hookOnly) and\n preventing SDK timeout errors when timeout is not specified\n #31421\n - Feature: allow concurrent dependency build with atomic file\n write #30984\n - Feature: added a --no-headers flag to the 'helm repo list'\n command, allowing users to suppress table headers in the\n output. Useful for scripting and automation #31448\n - SDK feature: added a LoadArchive to common loader #31462\n - SDK feature: introduced support for custom kstatus readers\n #31706\n - Fixed bug where a plugin name could already be used by\n another command #31427\n - Fixed bug where --server-side flag was not passed to install\n when using upgrade --install #31635\n - Fixed bug where HELM_ environment variables were not passed\n to plugins. this fixes a regression which was blocking some\n getter plugins #31613\n - Fixed bug where Helm test --logs failed with\n hook-delete-policy \"hook-failed\" or \"hook-succeed\" #31579\n - Fixed kube client logging issue #31560\n - Fixed regression where vendor-specific suffixes were stripped\n from .Capabilities.KubeVersion.GitVersion, breaking charts\n that detect managed Kubernetes platforms #31528\n - Fixed a bug where helm uninstall with --keep-history did not\n suspend previous deployed releases #12564\n - docs: updated helm template help text to document\n --api-versions #31683\n - docs: fixed documentation about default wait strategy\n - Update pkg/kube/statuswait.go\n - pkg/kube: introduce support for custom kstatus readers\n - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0\n - fix(release): fix test compilation error\n - Suppress SC2154 without changing behavior\n - Lint sync-repo.sh with ShellCheck\n - chore: move Evans Mungai from triage to maintainers\n - Replace reflect.Ptr with reflect.Pointer\n - fix: typo in the function names\n - Add documentation for --api-versions flag in template command\n - Fixing failing tests for cli-tools update\n - chore(deps): bump github.com/fluxcd/cli-utils\n - Replace deprecated `NewSimpleClientset`\n - docs(README): add mise alternate installation documentation\n - enable exhaustive linter\n - fix: add default casess to switch statements\n - build: set kube version via `debug.BuildInfo`\n - chore(deps): bump github.com/tetratelabs/wazero from 1.10.1\n to 1.11.0\n - doc: update based on review suggestion\n - test(statuswait): fix Copilot code review suggestion for\n goroutine in tests\n - test(statuswait): add more tests suggested by Copilot code\n review\n - test(statuswait): add some tests for statuswait\n - fix: use namespace-scoped watching to avoid cluster-wide LIST\n permissions\n - fix(doc): Update default wait strategy\n - Update to use slog\n - Fix TestCliPluginExitCode\n - Check plugin name is not used\n - Fix `TestConcurrencyDownloadIndex` typo\n - Use errors.Is to check for io.EOF and gzip.ErrHeader\n - chore(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0\n - chore: fix some comments to improve readability\n - feat: move TerryHowe triage to maintainers\n - Use latest patch release of Go in releases\n - fix(upgrade): pass --server-side flag to install when using\n upgrade --install\n - chore(deps): bump github.com/spf13/cobra from 1.10.1 to\n 1.10.2\n - chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0\n - Run the vulnerability check on PR that change the file\n - Fix govulncheck in CI\n - Update the govulncheck.yml to run on change\n - Enable the sloglint linter\n - fix(cli): handle nil config in EnvSettings.Namespace()\n - fix(getter): pass settings environment variables\n - fixes comment in install.go\n - chore(deps): bump actions/stale from 10.1.0 to 10.1.1\n - chore(deps): bump golangci/golangci-lint-action from 9.1.0 to\n 9.2.0\n - fixes tests after merge\n - fixes lint issue\n - updates tests after rebase from master\n - Add tests to action package to improve coverage\n - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1\n - Inform we use a different golangci-lint version than the CI\n - Deal with golint warning with private executeShutdownFunc\n - Use length check for MetaDependencies instead of nil\n comparison\n - Code review\n - Fix linting issue\n - Update pkg/action/hooks.go\n - added check for nil shutdown\n - cleaned up empty line\n - updated comment and made defer of shutdown function return\n errors as before and not the possible shutdown error\n - added shutdown hook that is executed after the logs have been\n retrieved\n - chore: fix typo in pkg/downloader/chart_downloader.go\n - Bump required go version (`go.mod` version)\n - Use modernize to use newer Golang features.\n - Remove two redundant if-checks.\n - Fix kube client logging\n - chore(deps): bump golangci/golangci-lint-action from 9.0.0 to\n 9.1.0\n - chore(deps): bump actions/checkout from 5.0.1 to 6.0.0\n - chore(deps): bump actions/setup-go from 5.5.0 to 6.1.0\n - fix: prevent segmentation violation on empty yaml in multidoc\n - fix: prevent reporting fallback on version when none\n specified\n - fix: add missing context to debug logs\n - fix: preserve vendor suffixes in KubeVersion.GitVersion\n - chore(deps): bump actions/checkout from 5.0.0 to 5.0.1\n - fixup test\n - logs\n - fix\n - chore: add warning for registry login with namespace\n - style: linting\n - test: split tests between valid and invalid\n - test: convert tests to table drive tests\n - test: refactor TestMetadataLegacyValidate to be more generic\n - update tests\n - fix: Use server-side apply for object create during update\n - Copy adopted resource info\n - Refactor environment variable expansion in PrepareCommands\n and update tests\n - fix: correct LDFLAGS path for default Kubernetes version\n - fix: improve plugin name validation err messages early via\n unmarshalling\n - fix: Make invalid name error message more similar and move\n tests\n - fix: focus only on plugin name but give more info about what\n we get\n - Make validation error similar and explicit for both metadatas\n - fix: improve plugin name validation error messages\n - Fix syntax errors in the document\n - docs: Fix LFX Health Score badge URL in README.md\n - chore(deps): bump github.com/tetratelabs/wazero from 1.9.0 to\n 1.10.1\n - Publish Helm v4 -\u003e `helm-latest-version`\n - Adding script to download Helm v4\n - refactor: use strings.Builder to improve performance\n - chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.20.1 to\n 0.21.0\n - chore(deps): bump golangci/golangci-lint-action from 8.0.0 to\n 9.0.0\n - Update pkg/cmd/flags.go\n - Error strategy list match help\n - Prevent surprising failure with SDK when timeout is not set\n - Do not change the default waiting strategy when --wait is not\n set\n - Provide more help for SDK user when setting up WaitStrategy\n - Avoid confusion between `--wait` (watcher) and no --wait\n (hookOnly)\n - The default is not HookOnlyStrategy but WaitStrategy\n - Make wait strategy selection more obvious\n - Increase documentation of --wait flag\n - While testing SDK features for v4. I was surprised with the\n error:\n - fix: do not run release workflow on forks\n - Convert pkg/cmd/load_plugins.go to slog\n - Rename copilot-instructions.md to AGENTS.md\n - fix(rollback): `errors.Is` instead of string comp\n - fix(uninstall): supersede deployed releases\n - for remaining local variable case inconsistency\n - Properly test error messages on pull command's test\n - Adding a LoadArchive to common loader\n - for all other similar cases\n - chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.3\n to 0.22.4\n - chore: increase logging package test coverage\n - feat(repo): add --no-headers option to 'helm repo list'\n - chore: fix typo of public field\n - rename interface{} to any\n - test: protect unknown hook delete policies\n - chore: replace github.com/mitchellh/copystructure\n - fix: Fix Helm v4 release distribtion/get-helm-3 script\n - fix test\n - Make test scripts run without /bin/bash\n - Ignore duplicated URN in logs\n - chore: delete unused var in installer.go\n - fix: assign KUBECONFIG environment variable value to\n env.Kubeconfig\n - add concurrency test on write \u0026 load index file\n - update writing index files to writeAtomicFile\n - fix index concurrency\n- Update to version 4.0.5:\n - Fixed rollback error when a manifest is removed in a failed\n upgrade #13437\n - Fixed check to ensure CLI plugin does not load with the same\n name as an existing Helm command\n - Fixed helm test --logs failure with hook-delete-policy\n \"hook-failed\" or \"hook-succeed\" #9098\n - Fixed a bug where empty dependency lists were incorrectly\n treated as present\n - Fixed a bug where the watch library did not only watch\n namespaces associated with the objects\n - Fixed regression in downloader plugins environment variables\n #31612\n - Fixed bug where --server-side flag is not respected with helm\n upgrade --install #31627\n - For SDK users: exposed KUBECONFIG to env\n upgrade --install 1b6053d (Evans Mungai)\n 1e3ee1d (Zadkiel AHARONIAN)\n - fix(getter): pass settings environment variables 31bd995\n (Zadkiel AHARONIAN)\n goroutine in tests 41a6b36 (Mohsen Mottaghi)\n review 2a2e6f7 (Mohsen Mottaghi)\n - test(statuswait): add some tests for statuswait 3818c02\n (Mohsen Mottaghi)\n permissions 66cab24 (Mohsen Mottaghi)\n comparison abf2007 (Calvin Bui)\n 4b3de18 (Benoit Tigeot)\n - Code review 3212770 (Benoit Tigeot)\n - Fix linting issue 417aae9 (Benoit Tigeot)\n - Update pkg/action/hooks.go 6c838b4 (Michelle Fernandez\n Bieber)\n - added check for nil shutdown c5d87f2 (Michelle Fernandez\n - cleaned up empty line 53175b7 (Michelle Fernandez Bieber)\n errors as before and not the possible shutdown error d2df1ab\n (Michelle Fernandez Bieber)\n retrieved 5b223de (Michelle Fernandez Bieber)\n - Fix TestCliPluginExitCode e845b68 (tison)\n - Check plugin name is not used 30bfd57 (tison)\n - Fix rollback for missing resources 0fd2c41 (Feruzjon\n env.Kubeconfig b456e27 (LinPr)\n - fix(rollback): errors.Is instead of string comp e2021f8\n - fix(uninstall): supersede deployed releases af7c153 (Hidde\n- Update to version 4.0.4 (4.0.3 was not released):\n * Bump v4.0.2 CVE deps cd700e0 (George Jenkins)\n * Use latest patch release of Go in releases 9db13ee (Matt\n- Update to version 4.0.2:\n * fix: prevent reporting fallback on version when none specified\n * fix: prevent segmentation violation on empty yaml in multidoc\n * Ignore duplicated URN in logs\n * jsonschema: warn and ignore unresolved URN $ref to match\n v3.18.4\n * Publish Helm v4 -\u003e `helm-latest-version`\n * fix: Fix Helm v4 release distribtion/get-helm-3 script\n * Copy adopted resource info 12500dd (George Jenkins)\n * fixup test 1cf3841 (George Jenkins)\n * logs 32e2d08 (George Jenkins)\n * fix 4b6472f (George Jenkins)\n * fix: Use server-side apply for object create during update\n 9dfe3b3 (George Jenkins)\n * Fix kube client logging 861adc2 (Matt Farina)\n * update tests b2f7872 (yxxhero)\n * Refactor environment variable expansion in PrepareCommands and\n update tests 77f97a1 (yxxhero)\n * Fix syntax errors in the document a156195 (Fish-pro)\n * fix: correct LDFLAGS path for default Kubernetes version\n 2c0dcda (Benoit Tigeot)\n * New Features\n Helm 4 has numerous new features, but a few deserve\n highlighting here:\n - Redesigned plugin system that supports Web Assembly based\n plugins\n - Post-renderers are now plugins\n - Server side apply is now supported\n - Improved resource watching, to support waiting, based on\n kstatus\n - Local Content-based caching (e.g. for charts)\n - Logging via slog enabling SDK logging to integrate with\n modern loggers\n - Reproducible builds of chart archives\n - Updated SDK API including support for multiple chart API\n versions (new experimental v3 chart API version coming soon)\n * Compatibility with Helm v3\n Helm v4 is a major version with backward incompatible changes\n including to the flags and output of the Helm CLI and to the\n SDK.\n Please evaluate the changes to your workflows. The changes are\n not as extensive as those from Helm v2 to v3, with the goal\n that the majority of workflows remain compatible between Helm\n v3 and v4.\n Helm charts apiVersion v2 (majority of today's charts) will\n continue to be supported in Helm v4. Existing charts should\n continue to install, upgrade, and otherwise work. Please test\n the installation and upgrade of charts to ensure it works as\n expected. Changes (e.g., server side apply) may impact the\n experience.\n * Breaking Changes\n - Post-renderers implemented as plugins\n Post-renderers are implemented as plugins. With this change,\n it is no longer possible to pass an executable directly to\n helm render --post-renderer, but a plugin name must be\n passed. This might require updates to existing any\n post-renderer workflows.\n","status":"published","published":"2026-10-19T09:48:48Z","modified":"2026-10-27T17:23:10.85597584Z","updated_at":"2026-11-02T15:54:04.519245Z"}]},"sources_more":{"osv":12}}