{"id":"CVE-2026-71556","aliases":["AZL-94676","AZL-95484","DEBIAN-CVE-2026-71556","EUVD-2026-54526","GHSA-hc8v-wwc9-vgxm","GO-2026-6213","RHSA-2026:50953","RHSA-2026:60646","RHSA-2026:60793","RHSA-2026:66208","RHSA-2026:66421","RHSA-2026:68334","RHSA-2026:68335","ROOT-APP-GOBINARY-CVE-2026-71556","SUSE-SU-2026:23625-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:3916-1","SUSE-SU-2026:4082-1","SUSE-SU-2026:4286-1","SUSE-SU-2026:4408-1","SUSE-SU-2026:4628-1","UBUNTU-CVE-2026-71556","openSUSE-SU-2026:11694-1","openSUSE-SU-2026:11803-1","openSUSE-SU-2026:21761-1","openSUSE-SU-2026:21884-1","openSUSE-SU-2026:22032-1"],"status":"published","title":"go-git: Worktree operations may follow symlinks","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00357,"percentile":0.29881,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-08-07T16:37:40Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"github.com/go-git/go-git/v5","fixed_in":["5.19.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/go-git/go-git/v6","fixed_in":["6.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-20"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-git-go-git","fixed_in":["5.19.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-git-go-git-v6","fixed_in":["6.0.0~alpha.5-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"syft","fixed_in":["0:1.51.1-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"grype","fixed_in":["0:0.118.0-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/go-git/go-git/v5","fixed_in":["v5.19.1-aikido.1","v5.16.4-aikido.1","v5.16.3-aikido.1","v5.16.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/go-git/go-git/v5","fixed_in":["v5.19.1-root.io.1","v5.16.4-root.io.1","v5.16.3-root.io.1","v5.16.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.19.1"},{"fixed":"5.19.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-git/go-git/v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.0.0-alpha.4"},{"fixed":"6.0.0-alpha.5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-20"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1","5.11.0-2","5.11.0-3","5.11.0-4","5.12.0-1","5.13.2-1","5.14.0-1","5.16.2-1","5.17.0-1","5.17.1-1","5.19.1-1","5.19.2-1","5.4.2-3","5.4.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1","5.16.2-1","5.17.0-1","5.17.1-1","5.19.1-1","5.19.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.19.2-1"}]}],"versions":["5.14.0-1","5.16.2-1","5.17.0-1","5.17.1-1","5.19.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-git-go-git-v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0~alpha.5-1"}]}],"versions":["6.0.0~alpha.4-1","6.0.0~alpha.4-2","6.0.0~alpha4-1","6.0.0~alpha4-2","6~git20260305.2083cf94-1","6~git20260305.2083cf94-2","6~git20260305.2083cf94-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.19.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0-alpha.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.19.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0-alpha.5"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.73.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"syft","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.51.1-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.118.0-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"kube-state-metrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20.0-0.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.74.0-0.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el10","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el10em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.1::el9","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.el9em"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el10","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el10"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:edge_manager:1.2::el9","package":"flightctl-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Root:Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v5.19.1-aikido.1"},{"fixed":"v5.16.4-aikido.1"},{"fixed":"v5.16.3-aikido.1"},{"fixed":"v5.16.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/go-git/go-git/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v5.19.1-root.io.1"},{"fixed":"v5.16.4-root.io.1"},{"fixed":"v5.16.3-root.io.1"},{"fixed":"v5.16.0-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.29.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.29.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5226.0-150000.5.40.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5226.0-150000.5.40.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5226.0-150000.5.40.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5226.0-150000.5.40.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-4.52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2-3","5.4.2-3ubuntu0.1~esm1","5.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2-3build1","5.4.2-4","5.4.2-4ubuntu0.24.04.1","5.4.2-4ubuntu0.24.04.2","5.4.2-4ubuntu0.24.04.2+esm1","5.4.2-4ubuntu0.24.04.3","5.4.2-4ubuntu0.24.04.3+esm1","5.4.2-4ubuntu0.24.04.3+esm2","5.4.2-4ubuntu0.24.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.16.2-1","5.19.1-1","5.19.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-git-go-git-v6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0~alpha.4-1","6.0.0~alpha.4-2","6.0.0~alpha.5-1","6.0.0~alpha.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1","5.16.2-1","5.16.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5226.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19}],"products":[{"vendor":"go-git","product":"go-git"}],"references":[{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://github.com/advisories/GHSA-hc8v-wwc9-vgxm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71556","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71556.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71556","tags":["advisory"]},{"url":"https://github.com/go-git/go-git","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50953","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75593","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71556","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50953.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512562","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71556","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75593","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75593","tags":["advisory"]},{"url":"https://github.com/moby/buildkit/releases/tag/v0.31.2","tags":["article"]},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60646","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60646.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60793","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60793.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66208","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71557","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66208.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512557","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","tags":["article"]},{"url":"https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","tags":["article"]},{"url":"https://github.com/go-git/go-git/pull/2247","tags":["article"]},{"url":"https://github.com/go-git/go-git/pull/2254","tags":["article"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66421","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15789","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66421.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15789","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68334","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68334.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39831","tags":["advisory"]},{"url":"https://go.dev/cl/781662","tags":["article"]},{"url":"https://go.dev/issue/79566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5019","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41178","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/7880","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44740","tags":["advisory"]},{"url":"https://github.com/go-git/go-billy/releases/tag/v5.9.0","tags":["article"]},{"url":"https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","tags":["article"]},{"url":"https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46597","tags":["advisory"]},{"url":"https://go.dev/cl/781620","tags":["article"]},{"url":"https://go.dev/issue/79561","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5013","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","tags":["advisory"]},{"url":"https://go.dev/cl/794100","tags":["article"]},{"url":"https://go.dev/issue/80142","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81521","tags":["advisory"]},{"url":"https://pkg.go.dev/go.mongodb.org/mongo-driver/v2@v2.8.2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68335","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68335.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623625-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77354","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263916-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271995","tags":["report"]},{"url":"https://bugzilla.suse.com/1272078","tags":["report"]},{"url":"https://bugzilla.suse.com/1272090","tags":["report"]},{"url":"https://bugzilla.suse.com/1276978","tags":["report"]},{"url":"https://bugzilla.suse.com/1276987","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264082-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276981","tags":["report"]},{"url":"https://bugzilla.suse.com/1276994","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264286-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278681","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://bugzilla.suse.com/1276980","tags":["report"]},{"url":"https://bugzilla.suse.com/1276990","tags":["report"]},{"url":"https://bugzilla.suse.com/1278267","tags":["report"]},{"url":"https://bugzilla.suse.com/1278269","tags":["report"]},{"url":"https://bugzilla.suse.com/1278272","tags":["report"]},{"url":"https://bugzilla.suse.com/1278462","tags":["report"]},{"url":"https://bugzilla.suse.com/1278477","tags":["report"]},{"url":"https://bugzilla.suse.com/1278505","tags":["report"]},{"url":"https://bugzilla.suse.com/1278742","tags":["report"]},{"url":"https://bugzilla.suse.com/1278743","tags":["report"]},{"url":"https://bugzilla.suse.com/1278751","tags":["report"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279080","tags":["report"]},{"url":"https://bugzilla.suse.com/1279137","tags":["report"]},{"url":"https://bugzilla.suse.com/1279243","tags":["report"]},{"url":"https://bugzilla.suse.com/1279245","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://bugzilla.suse.com/1279263","tags":["report"]},{"url":"https://bugzilla.suse.com/1279386","tags":["report"]},{"url":"https://bugzilla.suse.com/1280175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-71556","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75890","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-71556","title":"go-git: Worktree operations may follow symlinks","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T16:37:40.058Z","modified":"2026-08-07T16:58:19.113Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-54526","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T16:37:40Z","modified":"2026-08-07T16:58:19Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:02:06.930016Z"}],"ghsa":[{"id":"GHSA-hc8v-wwc9-vgxm","title":"go-git: Worktree operations may follow symlinks","description":"## Impact\n\nA symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.\n\nThe `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.\n\nAs a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`.\n\nA symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration.\n\nExploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.\n\nApplications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability.\n\n## Patches\n\nThe issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.\n\nWorktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.\n\nUsers of filesystem-backed worktrees should upgrade to a patched version.\n\n### Credits\n\nThanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal: \nWe would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.","status":"published","published":"2026-08-07T16:38:15Z","modified":"2026-08-07T16:38:18Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-71556","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T17:17:10.15Z","modified":"2026-09-10T20:41:33.14Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-71556","title":"go-git: Worktree operations may follow symlinks","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T16:37:40.058Z","modified":"2026-10-28T02:30:58.899045118Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:45:15.511448Z"},{"id":"DEBIAN-CVE-2026-71556","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T17:17:10.15Z","modified":"2026-10-01T03:03:32.983831602Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"GHSA-hc8v-wwc9-vgxm","title":"go-git: Worktree operations may follow symlinks","description":"## Impact\n\nA symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path.\n\nThe `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.\n\nAs a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`.\n\nA symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration.\n\nExploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.\n\nApplications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability.\n\n## Patches\n\nThe issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.\n\nWorktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.\n\nUsers of filesystem-backed worktrees should upgrade to a patched version.\n\n### Credits\n\nThanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. :1st_place_medal: \nWe would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.","status":"published","published":"2026-08-07T16:38:15Z","modified":"2026-09-10T03:51:14.191962234Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RHSA-2026:50953","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-05T10:15:08Z","modified":"2026-10-20T10:10:32Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:60646","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-07T10:17:57Z","modified":"2026-10-20T10:12:16Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60793","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-07T10:17:58Z","modified":"2026-10-20T10:12:17Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:66208","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-10T10:17:12Z","modified":"2026-10-20T10:13:23Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66421","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-11T10:15:13Z","modified":"2026-10-20T10:13:31Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68334","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","status":"published","published":"2026-09-17T10:18:18Z","modified":"2026-10-20T10:14:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68335","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","status":"published","published":"2026-09-17T10:18:18Z","modified":"2026-10-20T10:14:11Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-71556","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T17:17:00Z","modified":"2026-10-17T13:00:47.013426011Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"AZL-94676","title":"CVE-2026-71556 affecting package cri-o 1.30.1-1","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T17:17:10Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-95484","title":"CVE-2026-71556 affecting package packer for versions less than 1.9.5-20","description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","status":"published","published":"2026-08-07T17:17:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"GO-2026-6213","title":"Worktree operations may follow symlinks in github.com/go-git/go-git","description":"Worktree operations may follow symlinks in github.com/go-git/go-git","status":"published","published":"2026-08-18T16:38:10Z","modified":"2026-09-01T03:55:58.377864937Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:11694-1","title":"amazon-ssm-agent-3.3.5226.0-1.1 on GA media","description":"These are all security issues fixed in the amazon-ssm-agent-3.3.5226.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:06.2720962Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11803-1","title":"alloy-1.19.2-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-09-18T18:23:08.624887714Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21761-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:30:23Z","modified":"2026-09-09T18:23:14.573173825Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21884-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues:\n\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278681).\n- CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).\n- CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage\n  (bsc#1276994).\n\nChanges for amazon-ssm-agent:\n\n- Update to version 3.3.5390.0\n * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3\n * Bump golang.org/x/crypto from v0.53.0 to v0.56.0\n * Bump golang.org/x/net from v0.56.0 to v0.57.0\n * Bump golang.org/x/sys from v0.46.0 to v0.47.0\n * Upgrade GoLang version from 1.25 to 1.26\n * Mint control-channel token after dial to fix AZ-fault token expiry\n * Resume patch documents interrupted by an external shutdown\n * Use systemctl for systemd in aws: configureDocker on Amazon Linux\n * Update greengrass component version to 1.3.5\n\n- Update to version 3.3.5226.0\n * Add bounds check for HeaderLength in AgentMessage Deserialize\n * Bump github.com/go-git/go-git/v5 to v5.19.2\n * Bump golang.org/x/sync to v0.21.0\n * Detect Azure Linux and potential future unregistered Linux platforms\n * Fix Windows session command parsing by removing shlex\n * Fix shell injection in Windows domainjoin plugin parameters\n * Prevent control channel deadlock on ProcessorBufferFull\n * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change\n * Update the logic for loading RegistrationInfo\n * Upgrade Go version to 1.25.13\n\n- Update to version 3.3.5068.0\n\n * Migrate from aws-sdk-go v1 to aws-sdk-go-v2\n * Fix flaky registration/connection channel tests\n * Sync AWS SDK fork in extra/ with multicloud vendor changes\n * Harden function create file with permissions in a single syscall\n * Upgrade Go version to 1.25.12\n * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0\n * Fix loopback bypass in remote-host port forwarding denylist\n\n- Update to version 3.3.4851.0\n\n * Add ECS/EKS credential endpoints and loopback to port-forward denylist\n * Canonicalize IP addresses before port-forwarding denylist check\n * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin\n instead of the -w flag\n * Fix false StuckAtInProgress timeout for associations with rate \u003e= 2h\n * Fix non-interactive session big file transfer issues\n * Prevent ssm-user race condition with flock-based serialization\n * Send AWS::EC2::Instance as source type when registered with provider EC2\n * Validate process name in orphan worker detection\n\n- Update to version 3.3.4793.0\n\n * Add multicloud support enabling SSM Agent registration with\n Azure cloud providers\n * Add support for the upcoming public key in the agent code\n","status":"published","published":"2026-09-20T03:28:14Z","modified":"2026-09-25T18:23:10.832163688Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:15:27Z","modified":"2026-10-09T17:23:14.415693669Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-71556","title":"CVE-2026-71556 in github.com/go-git/go-git/v5 - Patched by Root","description":"Root has patched CVE-2026-71556 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-22T06:47:36Z","modified":"2026-10-22T07:15:04.17674321Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2026:23625-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:32:03Z","modified":"2026-09-29T18:23:20.110594263Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24148-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:07:44Z","modified":"2026-10-16T17:23:10.706600173Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:3916-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of truncated/invalid UTF-8 input can lead to\n  infinite loop (bsc#1271995, bsc#1272078, bsc#1272090).\n- CVE-2026-71556: github.com/go-git/go-git/v5: symlink traversal issue in worktree operations allows for arbitrary file\n  reads/writes (bsc#1276978).\n- CVE-2026-71557: github.com/go-git/go-git/v5: improper reference name sanitization before construction of on-disk\n  paths under the reference storage directory can lead to arbitrary file writes (bsc#1276987).\n","status":"published","published":"2026-09-01T14:58:16Z","modified":"2026-09-10T18:23:20.867627541Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4082-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues:\n\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276981).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276994).\n\nChanges for amazon-ssm-agent:\n\n- Update to version 3.3.5226.0\n","status":"published","published":"2026-09-08T08:53:47Z","modified":"2026-09-13T18:23:20.368669675Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4286-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues:\n\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1278681)\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278681)\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278681).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276981).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276994).\n\nChanges for amazon-ssm-agent:\n\n- Update to version 3.3.5390.0\n","status":"published","published":"2026-09-22T16:08:49Z","modified":"2026-09-23T09:15:06.099161723Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4408-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\n- Update to version 1.19.2.\n- Update to version 1.19.1.\n- Update to version 1.19.0:\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n- Update to version 1.18.1:\n * Add nop receiver to OTel Engine\n","status":"published","published":"2026-10-01T07:07:12Z","modified":"2026-10-01T17:30:06.30494489Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4628-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278462 bsc#1278477 bsc#1278505).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276980).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276990).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278269 bsc#1279243 bsc#1279245 bsc#1279252 bsc#1279263\n  bsc#1279386).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278272\n  bsc#1279072 bsc#1279080 bsc#1279137).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278742 bsc#1278743 bsc#1278751 bsc#1278763).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1278267).\n\nNon security issue fixed:\n\n- terraform-provider-{aws,external,google,random,tls}: aarch64 build installs provider binary under linux_amd64 instead\n  of linux_arm64, breaking terraform init (bsc#1280175).\n","status":"published","published":"2026-10-12T14:58:46Z","modified":"2026-10-13T10:30:05.946541838Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}