{"id":"CVE-2026-56855","aliases":["ALSA-2026:70640","ALSA-2026:90424","AZL-111611","AZL-99123","AZL-99135","AZL-99147","AZL-99159","AZL-99168","AZL-99198","AZL-99210","AZL-99222","AZL-99255","AZL-99264","AZL-99270","AZL-99282","AZL-99309","AZL-99318","AZL-99381","DEBIAN-CVE-2026-56855","EUVD-2026-70267","GO-2026-6355","MGASA-2026-0586","RHSA-2026:70640","RLSA-2026:70640","RLSA-2026:90424","SUSE-SU-2026:23692-1","SUSE-SU-2026:23712-1","SUSE-SU-2026:23736-1","SUSE-SU-2026:23739-1","SUSE-SU-2026:23745-1","SUSE-SU-2026:23831-1","SUSE-SU-2026:23841-1","SUSE-SU-2026:23874-1","SUSE-SU-2026:23876-1","SUSE-SU-2026:23924-1","SUSE-SU-2026:23973-1","SUSE-SU-2026:23984-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:24213-1","SUSE-SU-2026:24282-1","SUSE-SU-2026:4209-1","SUSE-SU-2026:4270-1","SUSE-SU-2026:4272-1","SUSE-SU-2026:4286-1","SUSE-SU-2026:4292-1","SUSE-SU-2026:4293-1","SUSE-SU-2026:4308-1","SUSE-SU-2026:4372-1","SUSE-SU-2026:4392-1","SUSE-SU-2026:4408-1","SUSE-SU-2026:4628-1","SUSE-SU-2026:5167-1","UBUNTU-CVE-2026-56855","openSUSE-SU-2026:11685-1","openSUSE-SU-2026:11691-1","openSUSE-SU-2026:11698-1","openSUSE-SU-2026:11704-1","openSUSE-SU-2026:11717-1","openSUSE-SU-2026:11727-1","openSUSE-SU-2026:11731-1","openSUSE-SU-2026:11732-1","openSUSE-SU-2026:11752-1","openSUSE-SU-2026:11772-1","openSUSE-SU-2026:11820-1","openSUSE-SU-2026:11871-1","openSUSE-SU-2026:11920-1","openSUSE-SU-2026:12258-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21812-1","openSUSE-SU-2026:21814-1","openSUSE-SU-2026:21816-1","openSUSE-SU-2026:21824-1","openSUSE-SU-2026:21835-1","openSUSE-SU-2026:21841-1","openSUSE-SU-2026:21846-1","openSUSE-SU-2026:21861-1","openSUSE-SU-2026:21879-1","openSUSE-SU-2026:21882-1","openSUSE-SU-2026:21884-1","openSUSE-SU-2026:21924-1","openSUSE-SU-2026:21927-1","openSUSE-SU-2026:21983-1","openSUSE-SU-2026:21999-1","openSUSE-SU-2026:22032-1","openSUSE-SU-2026:22064-1"],"status":"published","title":"Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.005,"percentile":0.43322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-09-02T19:12:04Z","modified":"2026-11-11T13:00:04Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cf-cli","fixed_in":["8.7.11-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-buildx","fixed_in":["0.14.0-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.101.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.10-30"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.8.4-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.18-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-21"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-33"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-go.crypto","fixed_in":["1:0.56.0-1"],"sources":["osv"]},{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.56.0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hauler","fixed_in":["2.1.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trivy","fixed_in":["0.74.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gh","fixed_in":["2.100.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"keybase-client","fixed_in":["6.6.3-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-bug","fixed_in":["0.10.1-7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gitea-tea","fixed_in":["0.16.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["4.3.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.4-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.4-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cf-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.11-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.101.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.17.8-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-33"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.12.0-1","1:0.13.0-1","1:0.14.0-1","1:0.16.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.21.0-1","1:0.22.0-1","1:0.23.0-1","1:0.24.0-1","1:0.24.0-2","1:0.25.0-1","1:0.25.0-1~bpo12+1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.4.0-1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.56.0-1"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1"]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.56.0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-2.mga10"}]}],"bundled":41},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.4-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-150700.9.14.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.75.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-4.52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.42.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.6-1ubuntu3","2:1.6-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.8~1ubuntu1","2:1.9~2ubuntu1","2:1.10~4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.12~1ubuntu1","2:1.13~1ubuntu1","2:1.13~1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.17~0ubuntu1","2:1.17~1","2:1.18~0ubuntu1","2:1.18~0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.2-3","1.26.4-1","1.26.5-1","1.26.6-2","1.26.7-1","1.26.8-1","1.26.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27~rc1-1","1.27~rc2-1","1.27~rc3-1","1.27.0-1","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.26~1","2:1.27~1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26~rc3-2","1.26.0-1","1.26.8-1~ubuntu0.26.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.100.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"keybase-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.66","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.66.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gitea-tea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.11-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.7-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.6-bp160.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-160000.3.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"keybase-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp160.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.100.0-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.9.1-bp160.1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp160.4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.1-bp160.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"golang","product":"crypto"},{"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh"}],"references":[{"url":"https://go.dev/issue/81317","tags":["Issue Tracking","Vendor Advisory","web","report","article"]},{"url":"https://go.dev/cl/826524","tags":["Patch","web","fix","article","report"]},{"url":"https://groups.google.com/g/golang-announce/c/1y3fb2np35U","tags":["Mailing List","Vendor Advisory","web","article","report"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6355","tags":["Vendor Advisory","web","advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11395","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56855","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515839","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-70640.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90424","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111943","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78667","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528050","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556068","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90424.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","tags":["web","advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56855.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56855","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0586.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35806","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-75-2-2026-10-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-1-2026-09-04","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-0-2026-07-31","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-74-4-2026-07-08","tags":["web"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70640.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11395","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11395","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15789","tags":["advisory"]},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56855","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70640","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90424","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556068","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623692-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623712-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253357","tags":["report"]},{"url":"https://bugzilla.suse.com/1272118","tags":["report"]},{"url":"https://bugzilla.suse.com/1278597","tags":["report"]},{"url":"https://bugzilla.suse.com/1278967","tags":["report"]},{"url":"https://bugzilla.suse.com/1279297","tags":["report"]},{"url":"https://bugzilla.suse.com/1279414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623745-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623831-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623841-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623874-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276722","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623924-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272117","tags":["report"]},{"url":"https://bugzilla.suse.com/1278614","tags":["report"]},{"url":"https://bugzilla.suse.com/1279215","tags":["report"]},{"url":"https://bugzilla.suse.com/1282542","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264209-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248946","tags":["report"]},{"url":"https://bugzilla.suse.com/1262952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265799","tags":["report"]},{"url":"https://bugzilla.suse.com/1266179","tags":["report"]},{"url":"https://bugzilla.suse.com/1266639","tags":["report"]},{"url":"https://bugzilla.suse.com/1267176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272064","tags":["report"]},{"url":"https://bugzilla.suse.com/1276687","tags":["report"]},{"url":"https://bugzilla.suse.com/1278621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264270-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264272-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264286-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276981","tags":["report"]},{"url":"https://bugzilla.suse.com/1276994","tags":["report"]},{"url":"https://bugzilla.suse.com/1278681","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264293-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264308-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278666","tags":["report"]},{"url":"https://bugzilla.suse.com/1279033","tags":["report"]},{"url":"https://bugzilla.suse.com/1279236","tags":["report"]},{"url":"https://bugzilla.suse.com/1279333","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264372-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264392-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://bugzilla.suse.com/1276980","tags":["report"]},{"url":"https://bugzilla.suse.com/1276990","tags":["report"]},{"url":"https://bugzilla.suse.com/1278267","tags":["report"]},{"url":"https://bugzilla.suse.com/1278269","tags":["report"]},{"url":"https://bugzilla.suse.com/1278272","tags":["report"]},{"url":"https://bugzilla.suse.com/1278462","tags":["report"]},{"url":"https://bugzilla.suse.com/1278477","tags":["report"]},{"url":"https://bugzilla.suse.com/1278505","tags":["report"]},{"url":"https://bugzilla.suse.com/1278742","tags":["report"]},{"url":"https://bugzilla.suse.com/1278743","tags":["report"]},{"url":"https://bugzilla.suse.com/1278751","tags":["report"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279080","tags":["report"]},{"url":"https://bugzilla.suse.com/1279137","tags":["report"]},{"url":"https://bugzilla.suse.com/1279243","tags":["report"]},{"url":"https://bugzilla.suse.com/1279245","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://bugzilla.suse.com/1279263","tags":["report"]},{"url":"https://bugzilla.suse.com/1279386","tags":["report"]},{"url":"https://bugzilla.suse.com/1280175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265167-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278574","tags":["report"]},{"url":"https://bugzilla.suse.com/1278869","tags":["report"]},{"url":"https://bugzilla.suse.com/1279184","tags":["report"]},{"url":"https://bugzilla.suse.com/1279276","tags":["report"]},{"url":"https://bugzilla.suse.com/1285255","tags":["report"]},{"url":"https://bugzilla.suse.com/1286984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287039","tags":["report"]},{"url":"https://bugzilla.suse.com/1287131","tags":["report"]},{"url":"https://bugzilla.suse.com/1287260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-56855","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83530","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://bugzilla.suse.com/1278447","tags":["report"]},{"url":"https://bugzilla.suse.com/1278625","tags":["report"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1278584","tags":["report"]},{"url":"https://bugzilla.suse.com/1238699","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241838","tags":["report"]},{"url":"https://bugzilla.suse.com/1251495","tags":["report"]},{"url":"https://bugzilla.suse.com/1251689","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1260295","tags":["report"]},{"url":"https://bugzilla.suse.com/1262269","tags":["report"]},{"url":"https://bugzilla.suse.com/1279234","tags":["report"]},{"url":"https://bugzilla.suse.com/1279315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://bugzilla.suse.com/1280111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://bugzilla.suse.com/1278934","tags":["report"]},{"url":"https://bugzilla.suse.com/1279296","tags":["report"]},{"url":"https://bugzilla.suse.com/1279416","tags":["report"]},{"url":"https://bugzilla.suse.com/1278586","tags":["report"]},{"url":"https://bugzilla.suse.com/1278604","tags":["report"]},{"url":"https://bugzilla.suse.com/1266208","tags":["report"]},{"url":"https://bugzilla.suse.com/1276703","tags":["report"]},{"url":"https://bugzilla.suse.com/1278643","tags":["report"]},{"url":"https://bugzilla.suse.com/1279548","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-56855","title":"Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T19:37:05.807Z","modified":"2026-09-03T14:14:40.169Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-70267","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T19:37:05Z","modified":"2026-09-03T14:14:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:13.671159Z"}],"nvd":[{"id":"CVE-2026-56855","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36.397Z","modified":"2026-09-04T16:34:56.823Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-56855","title":"Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T19:37:05.807Z","modified":"2026-11-11T13:12:16.643556646Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:40:09.010523Z"},{"id":"DEBIAN-CVE-2026-56855","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36.397Z","modified":"2026-10-01T03:03:27.285935587Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHSA-2026:70640","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2026-09-24T10:15:03Z","modified":"2026-10-20T10:14:42Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:70640","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.\n\nSecurity Fix(es):\n\n* buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T18:05:00.461776Z","modified":"2026-09-24T18:24:42.165328695Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:90424","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:09.468138Z","modified":"2026-10-29T12:30:03.192906069Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-56855","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:00Z","modified":"2026-11-09T12:49:55.232885498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T13:27:33.428057Z"},{"id":"ALSA-2026:70640","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.  \n\nSecurity Fix(es):  \n\n  * buildah: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n  * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n  * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n  * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n  * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-10-29T11:42:20.205890205Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:90424","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n  * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.891147014Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-111611","title":"CVE-2026-56855 affecting package kubevirt-openvmm 1.9.0-1","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-99123","title":"CVE-2026-56855 affecting package buildah 1.43.1-3","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99135","title":"CVE-2026-56855 affecting package cri-o 1.30.1-1","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99147","title":"CVE-2026-56855 affecting package podman 5.6.1-10","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99159","title":"CVE-2026-56855 affecting package cert-manager for versions less than 1.12.15-14","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99168","title":"CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99198","title":"CVE-2026-56855 affecting package docker-buildx for versions less than 0.14.0-17","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99210","title":"CVE-2026-56855 affecting package docker-compose for versions less than 2.27.0-14","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99222","title":"CVE-2026-56855 affecting package gh for versions less than 2.101.0-1","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-09-23T14:18:06.550854944Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99255","title":"CVE-2026-56855 affecting package kubernetes for versions less than 1.30.10-30","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99264","title":"CVE-2026-56855 affecting package kubevirt for versions less than 1.8.4-2","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99270","title":"CVE-2026-56855 affecting package libcontainers-common 20240213-3","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99282","title":"CVE-2026-56855 affecting package moby-engine for versions less than 25.0.18-1","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99309","title":"CVE-2026-56855 affecting package nvidia-container-toolkit 1.17.8-4","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99318","title":"CVE-2026-56855 affecting package packer for versions less than 1.9.5-21","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99381","title":"CVE-2026-56855 affecting package telegraf for versions less than 1.31.0-33","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T20:17:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"GO-2026-6355","title":"Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh","description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","status":"published","published":"2026-09-02T19:12:04Z","modified":"2026-09-24T10:41:42.556134596Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"MGASA-2026-0586","title":"Updated rclone package fixes security vulnerabilities","description":"This update brings new features, bugs and vulnerabilities fixed in the\nrclone and golang components used to build it.\n","status":"published","published":"2026-11-10T16:31:41Z","modified":"2026-11-10T16:45:03.103329652Z","updated_at":"2026-11-10T17:04:13.670671Z"},{"id":"openSUSE-SU-2026:11685-1","title":"hauler-2.1.0-2.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.943417801Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11691-1","title":"trivy-0.74.0-3.1 on GA media","description":"These are all security issues fixed in the trivy-0.74.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.948189491Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11698-1","title":"gh-2.100.0-1.1 on GA media","description":"These are all security issues fixed in the gh-2.100.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.976879368Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11704-1","title":"kbfs-6.6.3-4.1 on GA media","description":"These are all security issues fixed in the kbfs-6.6.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.982756784Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11717-1","title":"git-bug-0.10.1-7.1 on GA media","description":"These are all security issues fixed in the git-bug-0.10.1-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:05.705494578Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11727-1","title":"rclone-1.75.1-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:04.97152798Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11731-1","title":"containerized-data-importer1.65-api-1.65.0-3.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:22.462847721Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11732-1","title":"containerized-data-importer1.66-api-1.66.1-1.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:18.656014419Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11752-1","title":"kubevirt1.9-container-disk-1.9.0-3.1 on GA media","description":"These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.339908969Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11772-1","title":"gitea-tea-0.16.0-1.1 on GA media","description":"These are all security issues fixed in the gitea-tea-0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:04.991319902Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11820-1","title":"helm-4.3.0-1.1 on GA media","description":"These are all security issues fixed in the helm-4.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-19T00:00:00Z","modified":"2026-09-20T16:15:03.278830574Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11871-1","title":"cosign-3.1.3-1.1 on GA media","description":"These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:08.546235303Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11920-1","title":"grafana-12.4.11-1.1 on GA media","description":"These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:14.025740075Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12258-1","title":"zk-0.15.7-1.1 on GA media","description":"These are all security issues fixed in the zk-0.15.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:12.83344843Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA\n  certificates (bsc#1258543).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278624).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279390).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1279392).\n","status":"published","published":"2026-09-07T15:03:57Z","modified":"2026-09-10T18:23:46.123242111Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21812-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:52:09Z","modified":"2026-09-10T18:23:18.964541257Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21814-1","title":"Security update for zk","description":"This update for zk fixes the following issues:\n\nChanges in zk:\n\n- Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447):\n  * Upgrade golang.org/x/crypto to v0.56.0 to fix security\n    vulnerabilities in the embedded x/crypto/ssh package:\n    - CVE-2026-56854: authentication bypass\n    - CVE-2026-56855: deadlock vulnerability\n    - CVE-2026-78662: deadlock vulnerability\n","status":"published","published":"2026-09-08T09:46:55Z","modified":"2026-09-10T18:23:18.955090295Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21816-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).\n","status":"published","published":"2026-09-09T13:49:24Z","modified":"2026-09-10T17:00:03.90592706Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","description":"This update for containerized-data-importer1.65 fixes the following issues:\n\n- CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241838).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251495).\n- CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or\n  (bsc#1253506).\n- CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).\n- CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).\n- CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251689).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267176).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260295).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265799).\n- CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262952).\n- CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service\n  (bsc#1262269).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266639).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,\n  CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276687).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278621).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279315).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).\n","status":"published","published":"2026-09-09T15:12:11Z","modified":"2026-09-12T18:23:08.1084477Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21835-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).\n- CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication\n  callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).\n- CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and\n  denial of service (bsc#1278624).\n- CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection\n  deadlocks and denial of service (bsc#1278624).\n","status":"published","published":"2026-09-14T13:06:15Z","modified":"2026-09-15T17:00:06.114811433Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21841-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor.tar to fix:\n\n  * bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662:\n    hauler: golang.org/x/crypto/ssh: authentication bypass and\n    deadlocks in the crypto/ssh library\n\n- update vendor.tar to fix:\n\n  * bsc#1279416, CVE-2026-84304\n  * bsc#1279296, CVE-2026-84303\n  * bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via\n    crash due to missing ':authority' and 'Host' headers\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888).\n","status":"published","published":"2026-09-14T13:24:33Z","modified":"2026-09-15T17:00:06.103421664Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21846-1","title":"Security update for keybase-client","description":"This update for keybase-client fixes the following issues:\n\nChanges in keybase-client:\n\n- CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library\n  * Add update-go-crypto.patch to update affected dependency (bsc#1278586).\n- Update to go 1.26 as required to update go crypto library\n","status":"published","published":"2026-09-14T14:01:46Z","modified":"2026-09-15T17:00:06.116639615Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21861-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\nUpdate to version 2.100.0, fixing two deadlock issues in the vendored\ngolang.org/x/crypto/ssh library reachable via crafted SSH channel\nmessages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):\n  \n* Fix gh api telemetry disablement\n* Bump go-gh to v2.16.0\n* Expose per-host API host config\n* chore: bump toolchain to go1.26.8\n* chore: bump golang.org/x/crypto to 0.56.0\n* Record attachment invocation telemetry\n* Add webhook as an official extension\n* Merge pull request #14318 from cli/issue-triage-improvements\n* Refine GHES support wording\n* Use version-neutral GHES support link\n* Clarify supported GHES versions\n* Bump go-gh to v2.15.0\n* Remove redundant searcher comment\n* Remove unnecessary 204 on release edit\n* Remove redundant comment in gist create\n* Comment api command api_host usage\n* Comment missing api-client-rollout todo\n* Document when telemetry disabling is overzealous\n* Refactor AddAuthTokenHeader\n* Rename tokenGetter to config\n* build(deps): bump go-gh to rebased per-host api_host branch\n* refactor(attachments): send uploads through api.Client.DoRequest\n* test(internal/attachments): add new method required by interface\n* fix(api): compare request hostname without port when attaching auth token\n* test(acceptance): fix scriptfilter table field alignment\n* build(deps): bump go-gh to per-host api_host branch\n* chore(codeql): cover api.Client.Request in SafeURL path query\n* fix(auth/shared): route GetScopes path through safeurl\n* test(config): add coverage for APIHostForHost\n* test(config): cover deterministic api_host collision resolution\n* test(api): assert DoRequest preserves an explicit ContentLength\n* test(acceptance): cover selecting multiple scripts in one directory\n* refactor(api): use errors.AsType for HTTP error checks\n* fix(config): resolve api_host collisions deterministically\n* docs(api): clarify redirect method-rewriting in comments\n* Send release asset uploads and downloads through api.Client\n* Let callers set headers on a shared client request\n* Let a caller stop a request following redirects\n* Let a caller name the scopes an endpoint needs\n* Add a raw response request surface to api.Client\n* Send RenameRepo to a relative path\n* Make gh api honour api_host for relative paths\n* Send a host's token to its configured api_host\n* Add the api_host gateway harness\n* Let GH_ACCEPTANCE_SCRIPT name several scripts\n* Wait longer for the search index in the issues script\n* Add acceptance coverage for gist\n* Fix discussion acceptance test flags\n* Resolve aliases to their target when rendering full help on error\n* Print full help on command misuse for invoking agents\n\nUpdate to version 2.99.0:\n\n* Add repeatable --attach flag to upload local images/videos to\n  issues, pull requests, and comments (max 50 files per call)\n* Add worktree checkout support to gh issue develop --checkout\n  --worktree\n* Fix repo sync to avoid corrupting a linked worktree and to\n  explain when the target branch is checked out elsewhere\n* Fix pr merge --delete-branch to safely handle linked worktrees\n* Reject --comments combined with --json on view commands\n","status":"published","published":"2026-09-15T16:45:32Z","modified":"2026-09-17T18:23:14.640672457Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21879-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.631355474Z","updated_at":"2026-11-02T16:58:42.426393Z"}]},"sources_more":{"osv":35}}