{"id":"CVE-2026-78662","aliases":["AZL-111617","AZL-99126","AZL-99129","AZL-99144","AZL-99156","AZL-99165","AZL-99195","AZL-99207","AZL-99225","AZL-99249","AZL-99261","AZL-99273","AZL-99285","AZL-99312","AZL-99321","AZL-99384","DEBIAN-CVE-2026-78662","EUVD-2026-70266","GO-2026-6354","MGASA-2026-0586","SUSE-SU-2026:23692-1","SUSE-SU-2026:23712-1","SUSE-SU-2026:23736-1","SUSE-SU-2026:23739-1","SUSE-SU-2026:23745-1","SUSE-SU-2026:23831-1","SUSE-SU-2026:23841-1","SUSE-SU-2026:23874-1","SUSE-SU-2026:23876-1","SUSE-SU-2026:23924-1","SUSE-SU-2026:23973-1","SUSE-SU-2026:23984-1","SUSE-SU-2026:24148-1","SUSE-SU-2026:24213-1","SUSE-SU-2026:24282-1","SUSE-SU-2026:4209-1","SUSE-SU-2026:4270-1","SUSE-SU-2026:4272-1","SUSE-SU-2026:4286-1","SUSE-SU-2026:4292-1","SUSE-SU-2026:4293-1","SUSE-SU-2026:4308-1","SUSE-SU-2026:4372-1","SUSE-SU-2026:4392-1","SUSE-SU-2026:4408-1","SUSE-SU-2026:4628-1","SUSE-SU-2026:5167-1","UBUNTU-CVE-2026-78662","openSUSE-SU-2026:11727-1","openSUSE-SU-2026:12241-1","openSUSE-SU-2026:12258-1","openSUSE-SU-2026:12260-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21812-1","openSUSE-SU-2026:21814-1","openSUSE-SU-2026:21816-1","openSUSE-SU-2026:21824-1","openSUSE-SU-2026:21835-1","openSUSE-SU-2026:21841-1","openSUSE-SU-2026:21846-1","openSUSE-SU-2026:21861-1","openSUSE-SU-2026:21879-1","openSUSE-SU-2026:21882-1","openSUSE-SU-2026:21884-1","openSUSE-SU-2026:21924-1","openSUSE-SU-2026:21927-1","openSUSE-SU-2026:21983-1","openSUSE-SU-2026:21999-1","openSUSE-SU-2026:22032-1","openSUSE-SU-2026:22064-1"],"status":"published","title":"Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00431,"percentile":0.37798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-09-02T19:12:04Z","modified":"2026-11-11T13:00:04Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.15-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cf-cli","fixed_in":["8.7.11-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-buildx","fixed_in":["0.14.0-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.101.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.10-30"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.8.4-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.18-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-21"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-33"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-go.crypto","fixed_in":["1:0.56.0-1"],"sources":["osv"]},{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.56.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.15-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cf-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.11-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.101.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10-30"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.17.8-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-33"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.12.0-1","1:0.13.0-1","1:0.14.0-1","1:0.16.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.21.0-1","1:0.22.0-1","1:0.23.0-1","1:0.24.0-1","1:0.24.0-2","1:0.25.0-1","1:0.25.0-1~bpo12+1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.4.0-1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.56.0-1"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1"]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.56.0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-2.mga10"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-150700.9.14.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.75.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-4.52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-150000.5.43.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.42.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.6-1ubuntu3","2:1.6-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.8~1ubuntu1","2:1.9~2ubuntu1","2:1.10~4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.12~1ubuntu1","2:1.13~1ubuntu1","2:1.13~1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.17~0ubuntu1","2:1.17~1","2:1.18~0ubuntu1","2:1.18~0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.2-3","1.26.4-1","1.26.5-1","1.26.6-2","1.26.7-1","1.26.8-1","1.26.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27~rc1-1","1.27~rc2-1","1.27~rc3-1","1.27.0-1","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-defaults","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.26~1","2:1.27~1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26~rc3-2","1.26.0-1","1.26.8-1~ubuntu0.26.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.7-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"buildpacks-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.10-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260902T191204-160000.1.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.6-bp160.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-160000.3.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"keybase-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp160.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.100.0-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5390.0-160000.1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.9.1-bp160.1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp160.4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.1-bp160.1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"golang","product":"crypto"},{"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh"}],"references":[{"url":"https://go.dev/issue/81316","tags":["Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://go.dev/cl/826504","tags":["Patch","web","fix","report"]},{"url":"https://groups.google.com/g/golang-announce/c/1y3fb2np35U","tags":["Mailing List","Vendor Advisory","web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6354","tags":["Patch","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","tags":["web","advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78662.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-78662","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0586.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35806","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-75-2-2026-10-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-1-2026-09-04","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-0-2026-07-31","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-74-4-2026-07-08","tags":["web"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623692-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623712-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253357","tags":["report"]},{"url":"https://bugzilla.suse.com/1272118","tags":["report"]},{"url":"https://bugzilla.suse.com/1278597","tags":["report"]},{"url":"https://bugzilla.suse.com/1278967","tags":["report"]},{"url":"https://bugzilla.suse.com/1279297","tags":["report"]},{"url":"https://bugzilla.suse.com/1279414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623745-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623831-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623841-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623874-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276722","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623924-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272117","tags":["report"]},{"url":"https://bugzilla.suse.com/1278614","tags":["report"]},{"url":"https://bugzilla.suse.com/1279215","tags":["report"]},{"url":"https://bugzilla.suse.com/1282542","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264209-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248946","tags":["report"]},{"url":"https://bugzilla.suse.com/1262952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265799","tags":["report"]},{"url":"https://bugzilla.suse.com/1266179","tags":["report"]},{"url":"https://bugzilla.suse.com/1266639","tags":["report"]},{"url":"https://bugzilla.suse.com/1267176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272064","tags":["report"]},{"url":"https://bugzilla.suse.com/1276687","tags":["report"]},{"url":"https://bugzilla.suse.com/1278621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264270-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264272-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264286-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276981","tags":["report"]},{"url":"https://bugzilla.suse.com/1276994","tags":["report"]},{"url":"https://bugzilla.suse.com/1278681","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264293-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264308-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278666","tags":["report"]},{"url":"https://bugzilla.suse.com/1279033","tags":["report"]},{"url":"https://bugzilla.suse.com/1279236","tags":["report"]},{"url":"https://bugzilla.suse.com/1279333","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264372-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264392-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://bugzilla.suse.com/1276980","tags":["report"]},{"url":"https://bugzilla.suse.com/1276990","tags":["report"]},{"url":"https://bugzilla.suse.com/1278267","tags":["report"]},{"url":"https://bugzilla.suse.com/1278269","tags":["report"]},{"url":"https://bugzilla.suse.com/1278272","tags":["report"]},{"url":"https://bugzilla.suse.com/1278462","tags":["report"]},{"url":"https://bugzilla.suse.com/1278477","tags":["report"]},{"url":"https://bugzilla.suse.com/1278505","tags":["report"]},{"url":"https://bugzilla.suse.com/1278742","tags":["report"]},{"url":"https://bugzilla.suse.com/1278743","tags":["report"]},{"url":"https://bugzilla.suse.com/1278751","tags":["report"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279080","tags":["report"]},{"url":"https://bugzilla.suse.com/1279137","tags":["report"]},{"url":"https://bugzilla.suse.com/1279243","tags":["report"]},{"url":"https://bugzilla.suse.com/1279245","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://bugzilla.suse.com/1279263","tags":["report"]},{"url":"https://bugzilla.suse.com/1279386","tags":["report"]},{"url":"https://bugzilla.suse.com/1280175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265167-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278574","tags":["report"]},{"url":"https://bugzilla.suse.com/1278869","tags":["report"]},{"url":"https://bugzilla.suse.com/1279184","tags":["report"]},{"url":"https://bugzilla.suse.com/1279276","tags":["report"]},{"url":"https://bugzilla.suse.com/1285255","tags":["report"]},{"url":"https://bugzilla.suse.com/1286984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287039","tags":["report"]},{"url":"https://bugzilla.suse.com/1287131","tags":["report"]},{"url":"https://bugzilla.suse.com/1287260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-78662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78662","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61801","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://bugzilla.suse.com/1278447","tags":["report"]},{"url":"https://bugzilla.suse.com/1278625","tags":["report"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1278584","tags":["report"]},{"url":"https://bugzilla.suse.com/1238699","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241838","tags":["report"]},{"url":"https://bugzilla.suse.com/1251495","tags":["report"]},{"url":"https://bugzilla.suse.com/1251689","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1260295","tags":["report"]},{"url":"https://bugzilla.suse.com/1262269","tags":["report"]},{"url":"https://bugzilla.suse.com/1279234","tags":["report"]},{"url":"https://bugzilla.suse.com/1279315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://bugzilla.suse.com/1280111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://bugzilla.suse.com/1278934","tags":["report"]},{"url":"https://bugzilla.suse.com/1279296","tags":["report"]},{"url":"https://bugzilla.suse.com/1279416","tags":["report"]},{"url":"https://bugzilla.suse.com/1278586","tags":["report"]},{"url":"https://bugzilla.suse.com/1278604","tags":["report"]},{"url":"https://bugzilla.suse.com/1266208","tags":["report"]},{"url":"https://bugzilla.suse.com/1276703","tags":["report"]},{"url":"https://bugzilla.suse.com/1278643","tags":["report"]},{"url":"https://bugzilla.suse.com/1279548","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-78662","title":"Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T19:37:05.741Z","modified":"2026-09-03T13:20:12.263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-70266","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T19:37:05Z","modified":"2026-09-03T13:20:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:14.198061Z"}],"nvd":[{"id":"CVE-2026-78662","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37.167Z","modified":"2026-09-04T16:33:34.057Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"CVE-2026-78662","title":"Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T19:37:05.741Z","modified":"2026-11-11T13:12:17.118163645Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-11T13:40:09.010523Z"},{"id":"DEBIAN-CVE-2026-78662","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37.167Z","modified":"2026-10-01T03:03:42.102377846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"UBUNTU-CVE-2026-78662","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:00Z","modified":"2026-11-09T12:52:32.67841628Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-09T13:26:05.568602Z"},{"id":"AZL-111617","title":"CVE-2026-78662 affecting package kubevirt-openvmm 1.9.0-1","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-99126","title":"CVE-2026-78662 affecting package buildah 1.43.1-3","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99129","title":"CVE-2026-78662 affecting package cri-o 1.30.1-1","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99144","title":"CVE-2026-78662 affecting package podman 5.6.1-10","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99156","title":"CVE-2026-78662 affecting package cert-manager for versions less than 1.12.15-14","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99165","title":"CVE-2026-78662 affecting package cf-cli for versions less than 8.7.11-9","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99195","title":"CVE-2026-78662 affecting package docker-buildx for versions less than 0.14.0-17","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99207","title":"CVE-2026-78662 affecting package docker-compose for versions less than 2.27.0-14","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99225","title":"CVE-2026-78662 affecting package gh for versions less than 2.101.0-1","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-09-23T14:18:06.492653048Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99249","title":"CVE-2026-78662 affecting package kubernetes for versions less than 1.30.10-30","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99261","title":"CVE-2026-78662 affecting package kubevirt for versions less than 1.8.4-2","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99273","title":"CVE-2026-78662 affecting package libcontainers-common 20240213-3","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99285","title":"CVE-2026-78662 affecting package moby-engine for versions less than 25.0.18-1","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99312","title":"CVE-2026-78662 affecting package nvidia-container-toolkit 1.17.8-4","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99321","title":"CVE-2026-78662 affecting package packer for versions less than 1.9.5-21","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99384","title":"CVE-2026-78662 affecting package telegraf for versions less than 1.31.0-33","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T20:17:37Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"GO-2026-6354","title":"Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh","description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","status":"published","published":"2026-09-02T19:12:04Z","modified":"2026-09-03T10:10:55.147673102Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"MGASA-2026-0586","title":"Updated rclone package fixes security vulnerabilities","description":"This update brings new features, bugs and vulnerabilities fixed in the\nrclone and golang components used to build it.\n","status":"published","published":"2026-11-10T16:31:41Z","modified":"2026-11-10T16:45:03.103329652Z","updated_at":"2026-11-10T17:04:13.670671Z"},{"id":"openSUSE-SU-2026:11727-1","title":"rclone-1.75.1-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:04.97152798Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12241-1","title":"kubevirt1.8-container-disk-1.8.4-7.1 on GA media","description":"These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:09.36502555Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12258-1","title":"zk-0.15.7-1.1 on GA media","description":"These are all security issues fixed in the zk-0.15.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:12.83344843Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12260-1","title":"buildpacks-cli-0.40.10-1.1 on GA media","description":"These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-24T00:00:00Z","modified":"2026-10-25T17:30:03.893920917Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA\n  certificates (bsc#1258543).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278624).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279390).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1279392).\n","status":"published","published":"2026-09-07T15:03:57Z","modified":"2026-09-10T18:23:46.123242111Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21812-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:52:09Z","modified":"2026-09-10T18:23:18.964541257Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21814-1","title":"Security update for zk","description":"This update for zk fixes the following issues:\n\nChanges in zk:\n\n- Update Go vendored dependencies to resolve security issues (boo#1278625, boo#1278447):\n  * Upgrade golang.org/x/crypto to v0.56.0 to fix security\n    vulnerabilities in the embedded x/crypto/ssh package:\n    - CVE-2026-56854: authentication bypass\n    - CVE-2026-56855: deadlock vulnerability\n    - CVE-2026-78662: deadlock vulnerability\n","status":"published","published":"2026-09-08T09:46:55Z","modified":"2026-09-10T18:23:18.955090295Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21816-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).\n","status":"published","published":"2026-09-09T13:49:24Z","modified":"2026-09-10T17:00:03.90592706Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","description":"This update for containerized-data-importer1.65 fixes the following issues:\n\n- CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241838).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251495).\n- CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or\n  (bsc#1253506).\n- CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).\n- CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).\n- CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251689).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267176).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260295).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265799).\n- CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262952).\n- CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service\n  (bsc#1262269).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266639).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,\n  CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276687).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278621).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279315).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).\n","status":"published","published":"2026-09-09T15:12:11Z","modified":"2026-09-12T18:23:08.1084477Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21835-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).\n- CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication\n  callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).\n- CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and\n  denial of service (bsc#1278624).\n- CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection\n  deadlocks and denial of service (bsc#1278624).\n","status":"published","published":"2026-09-14T13:06:15Z","modified":"2026-09-15T17:00:06.114811433Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21841-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor.tar to fix:\n\n  * bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662:\n    hauler: golang.org/x/crypto/ssh: authentication bypass and\n    deadlocks in the crypto/ssh library\n\n- update vendor.tar to fix:\n\n  * bsc#1279416, CVE-2026-84304\n  * bsc#1279296, CVE-2026-84303\n  * bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via\n    crash due to missing ':authority' and 'Host' headers\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888).\n","status":"published","published":"2026-09-14T13:24:33Z","modified":"2026-09-15T17:00:06.103421664Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21846-1","title":"Security update for keybase-client","description":"This update for keybase-client fixes the following issues:\n\nChanges in keybase-client:\n\n- CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library\n  * Add update-go-crypto.patch to update affected dependency (bsc#1278586).\n- Update to go 1.26 as required to update go crypto library\n","status":"published","published":"2026-09-14T14:01:46Z","modified":"2026-09-15T17:00:06.116639615Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21861-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\nUpdate to version 2.100.0, fixing two deadlock issues in the vendored\ngolang.org/x/crypto/ssh library reachable via crafted SSH channel\nmessages (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, bsc#1278604):\n  \n* Fix gh api telemetry disablement\n* Bump go-gh to v2.16.0\n* Expose per-host API host config\n* chore: bump toolchain to go1.26.8\n* chore: bump golang.org/x/crypto to 0.56.0\n* Record attachment invocation telemetry\n* Add webhook as an official extension\n* Merge pull request #14318 from cli/issue-triage-improvements\n* Refine GHES support wording\n* Use version-neutral GHES support link\n* Clarify supported GHES versions\n* Bump go-gh to v2.15.0\n* Remove redundant searcher comment\n* Remove unnecessary 204 on release edit\n* Remove redundant comment in gist create\n* Comment api command api_host usage\n* Comment missing api-client-rollout todo\n* Document when telemetry disabling is overzealous\n* Refactor AddAuthTokenHeader\n* Rename tokenGetter to config\n* build(deps): bump go-gh to rebased per-host api_host branch\n* refactor(attachments): send uploads through api.Client.DoRequest\n* test(internal/attachments): add new method required by interface\n* fix(api): compare request hostname without port when attaching auth token\n* test(acceptance): fix scriptfilter table field alignment\n* build(deps): bump go-gh to per-host api_host branch\n* chore(codeql): cover api.Client.Request in SafeURL path query\n* fix(auth/shared): route GetScopes path through safeurl\n* test(config): add coverage for APIHostForHost\n* test(config): cover deterministic api_host collision resolution\n* test(api): assert DoRequest preserves an explicit ContentLength\n* test(acceptance): cover selecting multiple scripts in one directory\n* refactor(api): use errors.AsType for HTTP error checks\n* fix(config): resolve api_host collisions deterministically\n* docs(api): clarify redirect method-rewriting in comments\n* Send release asset uploads and downloads through api.Client\n* Let callers set headers on a shared client request\n* Let a caller stop a request following redirects\n* Let a caller name the scopes an endpoint needs\n* Add a raw response request surface to api.Client\n* Send RenameRepo to a relative path\n* Make gh api honour api_host for relative paths\n* Send a host's token to its configured api_host\n* Add the api_host gateway harness\n* Let GH_ACCEPTANCE_SCRIPT name several scripts\n* Wait longer for the search index in the issues script\n* Add acceptance coverage for gist\n* Fix discussion acceptance test flags\n* Resolve aliases to their target when rendering full help on error\n* Print full help on command misuse for invoking agents\n\nUpdate to version 2.99.0:\n\n* Add repeatable --attach flag to upload local images/videos to\n  issues, pull requests, and comments (max 50 files per call)\n* Add worktree checkout support to gh issue develop --checkout\n  --worktree\n* Fix repo sync to avoid corrupting a linked worktree and to\n  explain when the target branch is checked out elsewhere\n* Fix pr merge --delete-branch to safely handle linked worktrees\n* Reject --comments combined with --json on view commands\n","status":"published","published":"2026-09-15T16:45:32Z","modified":"2026-09-17T18:23:14.640672457Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21879-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.631355474Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21882-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276722).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260911.00\n * Add support for all possible SCALIBR os extractor for linux (#1052)\n * Migrate presubmits from deb11 to deb12 (#1050)\n * Bump the go_modules group across 1 directory with 3 updates (#1047)\n * Introduce E2E v2 framework and inventory tests (#1039)\n * Remove test case for asserting JSON marshal error from task_state.go (#1045)\n * security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)\n * Add Configuration for SCALIBR (#1034)\n * add CheckState and Cleanup tests (#1008)\n * Improve unit tests for osinfo/osinfo_linux.go (#1020)\n * Bump github.com/go-git/go-git/v5 (#1036)\n * Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)\n * Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)\n * authenticate cloud build to use docker registry (#1030)\n * Migrate e2e build to internal image (#1024)\n * Upgrade google.golang.org/grpc to new version. (#1023)\n * Improve unit tests for ospatch/yum_update.go (#1012)\n * Improve unit tests for ospatch/updates.go (#1011)\n * Add unit tests for config/package_resource.go PART 2 (#1005)\n * Add unit tests for config/package_resource.go PART 1 (#1003)\n * Add unit tests for policies/local.go (#1015)\n * Add unit tests for repository_resource.go (#1002)\n * Add unit tests for installrecipe.go part 2 (#993)\n * Add unit tests for scalibr.go (#1019)\n * Add unit tests for installrecipe.go part 1 (#992)\n * Add test cases for policies/recipes/recipedb.go (#989)\n * Bump golang.org/x/crypto (#1021)\n * Add unit tests for policies/recipes/steps.go PART 3 (#976)\n * Add unit tests for policies/recipes/steps.go PART 2 (#975)\n * Bump golang.org/x/net (#1017)\n * upgrade x/net package. (#1018)\n * Add test cases for config/file_resource.go (#988)\n * Add unit tests for policies/recipes/artifacts.go (#985)\n * Add unit tests for policies/recipes/steps.go PART 1 (#974)\n * Add tests \u0026 bugfix for packages/trace.go (#939)\n * Add unit tests for agentendpoint/agentendpoint_beta.go (#983)\n * Replace yum install with yum update (#1009)\n * Bump github.com/containerd/containerd (#1013)\n * Add unit tests for policies/apt.go PART 2 (#957)\n * Add test cases for agentendpoint/task_state.go (#984)\n * Remove deprecated rhel-sap images and add new ones (#1007)\n * Add test cases for clog/clog.go (#986)\n","status":"published","published":"2026-09-19T22:39:23Z","modified":"2026-09-25T18:23:10.631636068Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21884-1","title":"Security update for amazon-ssm-agent","description":"This update for amazon-ssm-agent fixes the following issues:\n\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278681).\n- CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).\n- CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage\n  (bsc#1276994).\n\nChanges for amazon-ssm-agent:\n\n- Update to version 3.3.5390.0\n * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3\n * Bump golang.org/x/crypto from v0.53.0 to v0.56.0\n * Bump golang.org/x/net from v0.56.0 to v0.57.0\n * Bump golang.org/x/sys from v0.46.0 to v0.47.0\n * Upgrade GoLang version from 1.25 to 1.26\n * Mint control-channel token after dial to fix AZ-fault token expiry\n * Resume patch documents interrupted by an external shutdown\n * Use systemctl for systemd in aws: configureDocker on Amazon Linux\n * Update greengrass component version to 1.3.5\n\n- Update to version 3.3.5226.0\n * Add bounds check for HeaderLength in AgentMessage Deserialize\n * Bump github.com/go-git/go-git/v5 to v5.19.2\n * Bump golang.org/x/sync to v0.21.0\n * Detect Azure Linux and potential future unregistered Linux platforms\n * Fix Windows session command parsing by removing shlex\n * Fix shell injection in Windows domainjoin plugin parameters\n * Prevent control channel deadlock on ProcessorBufferFull\n * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change\n * Update the logic for loading RegistrationInfo\n * Upgrade Go version to 1.25.13\n\n- Update to version 3.3.5068.0\n\n * Migrate from aws-sdk-go v1 to aws-sdk-go-v2\n * Fix flaky registration/connection channel tests\n * Sync AWS SDK fork in extra/ with multicloud vendor changes\n * Harden function create file with permissions in a single syscall\n * Upgrade Go version to 1.25.12\n * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0\n * Fix loopback bypass in remote-host port forwarding denylist\n\n- Update to version 3.3.4851.0\n\n * Add ECS/EKS credential endpoints and loopback to port-forward denylist\n * Canonicalize IP addresses before port-forwarding denylist check\n * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin\n instead of the -w flag\n * Fix false StuckAtInProgress timeout for associations with rate \u003e= 2h\n * Fix non-interactive session big file transfer issues\n * Prevent ssm-user race condition with flock-based serialization\n * Send AWS::EC2::Instance as source type when registered with provider EC2\n * Validate process name in orphan worker detection\n\n- Update to version 3.3.4793.0\n\n * Add multicloud support enabling SSM Agent registration with\n Azure cloud providers\n * Add support for the upcoming public key in the agent code\n","status":"published","published":"2026-09-20T03:28:14Z","modified":"2026-09-25T18:23:10.832163688Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21924-1","title":"Security update for cloudflared","description":"This update for cloudflared fixes the following issues:\n\nChanges in cloudflared:\n\n- Update version to 2026.9.1\n  * Update vendor (boo#1278643, CVE-2026-56854, CVE-2026-78662, CVE-2026-56855)\n  * Propagate edge registration errors over QUIC and fix supervisor error\n    classification\n  * Negotiate protected mode during Quick Tunnel provisioning\n","status":"published","published":"2026-09-21T14:05:15Z","modified":"2026-09-25T18:23:13.337415435Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21927-1","title":"Security update for apptainer","description":"This update for apptainer fixes the following issues:\n\nChanges in apptainer:\n\n- Fix potential authentication bypass and deadlocks in the\n  crypto/ssh library by updating golang.org/x/crypto to v0.56.0.\n  CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)\n- Fix\n  * a potential DoS via crash due to missing ':authority' and\n    'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),\n  * a potential heap memory exhaustion via HTTP/2 DATA frame\n     fragmentation CVE-2026-84304 (bsc#1279236),\n  * a potential bypass of authorization policies via mixed-case\n    or canonical-case header matches due to an xDS RBAC HTTP filter\n    implementation issue CVE-2026-84303 (bsc#1279333)\n  by updating google.golang.org/grpc to v1.83.2\n","status":"published","published":"2026-09-21T13:53:22Z","modified":"2026-09-25T18:23:13.330991497Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21983-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.792813938Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21999-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.75.1: (boo#1279548)\n  - Security\n    - archive\n      - Fix zip slip path traversal in untrusted zip files\n        GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)\n      - Hide any archive entry which escapes the directory being\n        listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Reject unsafe entry names when mounting squashfs images\n        GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Fix zip subdirectory root matching sibling directories\n        GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Fix zip entry named \".\" hiding every other file\n        GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n      - Fix \"directory not found\" for archive paths containing \"./\"\n        or \"//\" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)\n    - build\n      - Fix multiple CVEs by upgrading to go1.26.6 (Nick\n        Craig-Wood)\n        - CVE-2026-56860: net/url: quadratic complexity in\n          resolvePath\n        - CVE-2026-56858: html/template: JavaScript regexp context\n          tracking\n        - CVE-2026-56862: crypto/tls: limit handshake messages\n          accepted post-handshake\n        - CVE-2026-56853: net/http: apply ReadHeaderTimeout to\n          unencrypted HTTP/2 check\n        - CVE-2026-56859: encoding/xml: recursion depth guard\n          during decode\n        - CVE-2026-33818: encoding/asn1: enforce maximum recursion\n          depth\n        - CVE-2026-46600: net: panic parsing an invalid SVCB or\n          HTTPS RR in dnsmessage\n        - CVE-2026-39821: net/http: reject ASCII-only\n          Punycode-encoded labels in idna\n      - Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs\n        (Nick Craig-Wood)\n        - CVE-2026-56854: ssh: source-address critical option not\n          enforced for non-public-key auth callbacks\n        - CVE-2026-78662: ssh: a malicious peer could flood an\n          undecided channel's incoming requests, deadlocking the\n          connection\n        - CVE-2026-56855: ssh: a malicious peer could send crafted\n          messages on an established channel, deadlocking the\n          connection\n      - Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603\n        (Nick Craig-Wood)\n        - CVE-2026-46603: excessive memory allocation during VP8L\n          decoding\n      - fs: Confine directory listing entries that escape the root\n        GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick\n        Craig-Wood)\n      - fshttp: Don't send --header values to other hosts on\n        redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)\n      - http: Don't leak configured headers to other hosts or over\n        plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick\n        Craig-Wood)\n      - lib/rest: Check HTTPS downgrades against the original\n        request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick\n        Craig-Wood)\n      - local\n        - Fix dir metadata escaping the root through a planted\n          symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)\n        - Fix btime escaping the root via a planted symlink\n          GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)\n        - Fix panic on Range request past the end of a symlink\n          GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)\n      - serve docker\n        - Reject volume names that escape the base directory\n          GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)\n        - Reject volume names resolving to the base directory\n          itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)\n        - Re-derive volume mountpoint from name when restoring\n          state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)\n      - serve ftp: Fix auth-proxy sessions sharing credentials by\n        username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)\n      - serve s3\n        - Fix memory exhaustion from client-declared multipart part\n          size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)\n        - Reject bogus multipart part sizes in the reorder buffer\n          GHSA-2p48-j3qc-rx9f (Nick Craig-Wood)\n        - Fix auth proxy accepting any request signed with an empty\n          secret GHSA-xwwr-4h3p-r22c CVE-PENDING (Nick Craig-Wood)\n        - NB the auth proxy protocol for serve s3 has changed - the\n          proxy program is now given the access key ID as user and\n          must return the secret as _secret_access_key\n        - Fix each server accepting the --auth-key credentials of\n          all the others (Nick Craig-Wood)\n        - Fix misleading anonymous access log when using an auth\n          proxy via rc GHSA-p569-5gjg-9cmj CVE-PENDING (Nick\n          Craig-Wood)\n      - serve sftp: Fix auth proxy configured via rc being silently\n        ignored GHSA-p569-5gjg-9cmj CVE-PENDING (Nick Craig-Wood)\n  - Bug Fixes\n    - accounting\n      - Fix memory leak on long-running rcd (nielash)\n      - Fix memory leak from stats groups on long-running rcd\n        (nielash)\n      - Fix bwlimit burst overflow (Rayan Salhab)\n    - bisync\n      - Fix memory leak when running via the rc (nielash)\n      - Fix failed transfers of empty files being recorded as\n        synced (Nick Craig-Wood)\n    - build: Make go1.26 the minimum required version as needed by\n      golang.org/x/crypto v0.56.0 (Nick Craig-Wood)\n    - config: Redact env var config values in logs (Pastalikek65)\n    - doc fixes (Anton Karpov, CAOShurong, Dean Chen, Nick\n      Craig-Wood, Recoordinate, Rodrigo Rodrigues, Shantanav\n      Mukherjee, shaurya)\n    - lib/batcher: Prevent commits racing shutdown (Loi Nguyen)\n    - lib/transform: Fix panic in truncate_keep_extension (VXNCXNX)\n    - multipart: Fix chunked uploads storing truncated objects when\n      the source ends early (Nick Craig-Wood)\n    - operations: Fix silent truncation of streaming uploads whose\n      source ends early (Nick Craig-Wood)\n    - serve\n      - Fix VFS instance leaks on server startup failures and\n        shutdown (Hakan İSMAİL)\n      - Pass the client IP address to the auth proxy\n        (am-at-enrollvb)\n    - serve http: Prevent scrolling to the top on page reload (Sune\n      Mølgaard)\n    - serve nfs: Fix EIO when creating symlinks with --vfs-links\n      (SillyZir)\n    - serve s3\n      - Fix failed uploads deleting or corrupting the object at the\n        key (Nick Craig-Wood)\n      - Fix crash when a multipart upload is aborted while a part\n        is uploading (Nick Craig-Wood)\n      - Fix modtime not being set when only mtime metadata is\n        supplied on PUT (Nick Craig-Wood)\n      - Upload all multipart uploads via the VFS so they obey\n        --bwlimit and show in stats (Nick Craig-Wood)\n      - Reserve the .rclone_temp_ prefix for temporary objects\n        (Nick Craig-Wood)\n      - Clean up abandoned multipart uploads after\n        --multipart-expiry (Nick Craig-Wood)\n    - vfscache\n      - Fix reader deadlock when the item size drops below the read\n        offset (Dave)\n      - Fix log message growing without bound on repeated write\n        errors (Vijay Misal)\n    - walk: Stop directory traversal when the context is cancelled\n      (Rahman Yilmaz)\n  - VFS\n    - Synchronize poll updates with shutdown (Loi Nguyen)\n    - Make poll shutdown lifecycle deterministic (Loi Nguyen)\n  - Crypt\n    - Fix hash mismatches with no_data_encryption on backends which\n      check upload hashes (Nick Craig-Wood)\n    - Fix directory names which look like versioned file names\n      (TowyTowy)\n    - Warn about directories with legacy version-like encrypted\n      names (Nick Craig-Wood)\n  - Azure Blob\n    - Fix Entra ID server-side copy source authentication (Edward\n      Klesel)\n    - Fix spurious vfs cache corruption errors during chunked reads\n      (Nick Craig-Wood)\n  - Azurefiles\n    - Fix zero padded files being created when the source ends\n      early (Nick Craig-Wood)\n  - Box\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Rohit Behera)\n  - Compress\n    - Fix corrupted objects being created when the source ends\n      early (Nick Craig-Wood)\n  - Drive\n    - Don't list trashed files when removing a directory into the\n      trash (alliasgher)\n  - Dropbox\n    - Preserve Paper export paths on lookup (Loi Nguyen)\n    - Fix context cancellation (e.g. --max-duration limit) not\n      stopping in-flight requests (debaditya)\n    - Fix chunked uploads of truncated files never finishing (Nick\n      Craig-Wood)\n    - Don't retry chunked upload requests when the upload has been\n      cancelled (Nick Craig-Wood)\n    - Decode received shared-file names (Sanjay Kanth A)\n    - Fix ChangeNotify when the root's case differs from Dropbox's\n      (Loi Nguyen)\n  - Filelu\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Nick Craig-Wood)\n    - Fix duplicate root path during multipart folder creation\n      (kingston125)\n  - Huaweidrive\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Rohit Behera)\n  - Iclouddrive\n    - Fix uploads into an app container failing with 412 (Christian\n      De Santis)\n  - Internetarchive\n    - Fix corrupted files being created when the source ends early\n      (Nick Craig-Wood)\n  - Internxt\n    - Persist rotated token returned by the user info call\n      (0rangeSeaW0lf)\n  - Onedrive\n    - Fix 403 Forbidden for configuration personal onedrive\n      (machsix)\n    - Fall back to manual drive ID entry when drive listing fails\n      (SillyZir)\n    - Don't retry multipart upload chunk on 404 (upload session not\n      found) (water)\n  - Overview\n    - Fix \"internal error: no overview data found\" on 32 bit\n      architectures (Nick Craig-Wood)\n  - Pikpak\n    - Fix truncated files being created when the source ends early\n      (Nick Craig-Wood)\n    - Fix truncated single part uploads reported as ok when source\n      ends early (Nick Craig-Wood)\n  - Protondrive\n    - Fix files uploaded with v1.75.0 not being readable in the\n      Proton apps (Nick Craig-Wood)\n    - Fix corrupted uploads after a retried upload error (Nick\n      Craig-Wood)\n  - Quatrix\n    - Fix chunk upload retries and fix memory leak (Nick\n      Craig-Wood)\n  - S3\n    - Update Mega endpoints (Nick Craig-Wood)\n    - Treat UploadPart success without ETag as retryable error\n      (CAOShurong)\n    - Fix server side copy failing with --s3-no-head-object\n      (Anatoly Tarnavsky)\n  - Sia\n    - Fix corrupted files being created when the source ends early\n      (Nick Craig-Wood)\n  - Smb\n    - Reuse the upload connection for SetModTime (alliasgher)\n  - WebDAV\n    - Fix SetModTime failing and hashes missing on Nextcloud (Nick\n      Craig-Wood)\n  - Yandex\n    - Fix truncated files being uploaded successfully when the\n      source ends early (Rohit Behera)\n\n- Update to version 1.75.0:\n  - New S3 Providers\n    - Scality (RING / ARTESCA)\n    - Zero Services (ZERO-Z3)\n  - Security\n    - archive: Don't crash on malformed squashfs images\n      GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood)\n    - ftp: Fix ftp command injection when encoding doesn't include\n      CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood)\n    - lib/http: Use TLS on all --addr listeners when --cert and\n      --key are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)\n    - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM\n      GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood)\n    - local: Stop source file names escaping the destination\n      directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood)\n    - rc\n      - Don't expose pprof debug handlers on an unauthenticated\n        server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood)\n      - Require authentication to list the remotes with --rc-serve\n        GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)\n      - Fix leaking stack traces on panics GHSA-gwfq-86j8-7qhv\n        (Nick Craig-Wood)\n    - s3\n      - Fix redirect credential leaks, reject HTTPS-\u003eHTTP and strip\n        secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)\n      - Strip S3 Express session token on cross-host redirects\n        GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood)\n      - serve ftp: Use constant time comparison for password check\n        GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood)\n      - serve restic: Fix path traversal above the served directory\n        GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood)\n      - serve sftp: Don't crash the whole server on a bad request\n        GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)\n      - sftp: Fix command injection via crafted filenames on\n        PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick\n        Craig-Wood)\n      - vfs: Don't crash the process if a backend panics on a\n        background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood)\n    - webdav\n      - Fix HTTPS to HTTP redirects leaking credentials\n        GHSA-h4mf-4v27-hggj (Nick Craig-Wood)\n      - Tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv\n        (Nick Craig-Wood)\n    - Update google.golang.org/grpc to fix multiple security\n      problems (Nick Craig-Wood)\n  - New Features\n    - build: Update all dependencies (Nick Craig-Wood)\n    - config\n      - Add config unset command to remove options from a remote\n        (Nick Craig-Wood)\n      - Add tier to config wizard (dougal)\n    - docker serve\n      - Add timeout to volume restore so slow remotes don't block\n        startup (Nick Craig-Wood)\n      - Restore volumes concurrently so one slow remote doesn't\n        block others (Nick Craig-Wood)\n      - Make Create idempotent to avoid \"volume already exists\"\n        after restart (Nick Craig-Wood)\n    - doc fixes (blackflytech, dougal, Giridhar, KTibow,\n      mathieulongtin, Nick Craig-Wood, p1, Socialpranker, Søren\n      Lindberg, yashanil98)\n    - filter\n      - Support nested {} alternates in glob filters (maximilize)\n      - Add --files-from0 to support NUL-delimited input (Gaurav)\n    - fserrors: Make http2 \"server sent GOAWAY\" a retriable error\n      (phatlc)\n    - fshttp\n      - Add --dump errors to dump only failed HTTP transactions\n        (Nick Craig-Wood)\n      - Add --dump trace to log connection level events via\n        httptrace (Nick Craig-Wood)\n    - gui\n      - Serve static files with gzip/deflate compression (Leon\n        Brocard)\n      - Respect explicit --rc-allow-origin instead of always\n        deriving it from the bind address (Kyue)\n      - Update embedded release to 1.1.11 (Nick Craig-Wood)\n    - mount2: Add --allow-idmap to advertise FUSE_ALLOW_IDMAP\n      (Valerij Fredriksen)\n    - nfsmount: Call mount_nfs directly on OpenBSD so -T is\n      accepted (Socialpranker)\n    - rc\n      - Respond with 202 if prefer-async header is passed (FTCHD)\n      - Add config/oauthstop and config/oauthstatus to control\n        oauth listener (FTCHD)\n      - Include OAuth authorization URL in rc config/oauthstatus\n        response (Hakan İSMAİL)\n      - Allow setting rc config and filter options as flat\n        parameters (Hakan İSMAİL)\n    - serve\n      - Support custom http response headers (kkocdko)\n      - Update serve remote control to accept nested as well as\n        flat options (Hakan İSMAİL)\n    - serve dlna: Bound SOAP request bodies (Acts1631)\n    - serve nfs\n      - Allow NFS clients to mount subpaths of the served remote\n        (Nick Craig-Wood)\n      - Advertise AUTH_UNIX so the *BSD NFS clients can mount\n        (Socialpranker)\n    - serve s3: Stream multipart uploads to the backend instead of\n      buffering in memory (Nick Craig-Wood)\n    - serve sftp\n      - Implement statvfs@openssh.com to report disk usage (Nick\n        Craig-Wood)\n      - Use the requested atime when setting file times (Nick\n        Craig-Wood)\n    - serve webdav: Add gzip compression for compressible responses\n      (Leon Brocard)\n    - serve http: Add --disable-dir-list flag (Leon Brocard)\n  - Bug Fixes\n    - archive/squashfs: Fix reading images with no fragment or\n      xattr table (maximilize)\n    - chunkedreader: Fix spurious errors when a parallel stream is\n      closed early (Nick Craig-Wood)\n    - config\n      - Fix config_template_file and config_template being ignored\n        via config/create (hexbinoct)\n      - Fix normalization when obscuring passwords (Nick\n        Craig-Wood)\n    - docker serve: Fix plugin timeout on restart when volumes have\n      active mounts (Nick Craig-Wood)\n    - fs: Fix passwords and tokens appearing in the debug log\n      during rclone config (Nick Craig-Wood)\n    - gui: Fix cross-origin API requests when bound to a wildcard\n      address (FTCHD)\n    - hash: Fix xxh128 hasher size (Yuhang Cao)\n    - log: Fix side effects when importing rclone as a library\n      (Sven Rebhan)\n    - march\n      - Fix unnecessarily listing dst directory when src listing\n        finished (Nick Craig-Wood)\n      - Fix goroutine leak on completed async rc jobs (Yash Anil)\n    - nfsmount: Fix mount_nfs options incompatible with OpenBSD\n      (Socialpranker)\n    - rc\n      - Fix operations/stat for directories with large parent dirs\n        (Nick Craig-Wood)\n      - Fix _filter and _config parameters being ignored by mount/*\n        commands (Hakan İSMAİL)\n    - serve: Fix auth proxy using stale config parameters when\n      making a backend (Nick Craig-Wood)\n    - serve s3\n      - Fix aborted multipart uploads appearing as ghosts (Nick\n        Craig-Wood)\n      - Fix streamed multipart uploads not being atomic (Nick\n        Craig-Wood)\n      - Fix OOM and InvalidPart errors with concurrent multipart\n        uploads (Nick Craig-Wood)\n    - sync: Fix --fix-case rename on backends that need upload\n      before overwrite (Nick Craig-Wood)\n    - Mount\n      - Support flat VFS and Mount options in mount RC command\n        (Hakan İSMAİL)\n    - VFS\n      - Fix IO error by recreating the cache file if it has been\n        removed (Nick Craig-Wood)\n      - Fix \"invalid seek position\" error when cache files larger\n        than the remote (Nick Craig-Wood)\n      - Fix vfs cache writeback timer not being stopped when\n        --transfers reached (Nick Craig-Wood)\n      - Fix crash when multiple mounts or servers share the same\n        VFS (Nick Craig-Wood)\n    - Local\n      - Add --local-fatal-if-no-space flag (ferrumclaudepilgrim)\n      - Don't resolve relative roots to absolute paths (Nick\n        Craig-Wood)\n    - Archive\n      - Fix squashfs listings failing with invalid argument after\n        update (Nick Craig-Wood)\n    - Azure Blob\n      - Fix MD5 being dropped on range reads causing vfs cache\n        re-downloads (Nick Craig-Wood)\n      - Add use_arrow_list flag for experimental Apache Arrow\n        listing (Nick Craig-Wood)\n      - List very large containers in parallel with\n        list_parallelism (Nick Craig-Wood)\n    - Azurefiles\n      - Fix incorrect modtime after uploading a file or setting its\n        modtime (Nick Craig-Wood)\n      - Improve modtime precision from 1s to 100ns (Nick\n        Craig-Wood)\n    - Combine\n      - Don't return an error message as the remote name for a bad\n        object (Nick Craig-Wood)\n    - Drime\n      - Remove stale mux_status field from Item (Nick Craig-Wood)\n    - Drive\n      - Warn in config wizard before using the shared client_id\n        (Nick Craig-Wood)\n      - Detect shortcut loops to avoid infinite recursion (Nick\n        Craig-Wood)\n    - Dropbox\n      - Add support for impersonate_admin (Gaurav)\n      - Add --dropbox-skip-shared-folders and\n        --dropbox-skip-unowned-folders (Gaurav)\n      - Make Rmdir use one less API call (Socialpranker)\n      - Use much less memory when uploading small files (Nick\n        Craig-Wood)\n      - Remove an unnecessary API call when uploading small files\n        (Nick Craig-Wood)\n    - Filen\n      - Fix incorrect modtime after updating a file or setting its\n        modtime (Nick Craig-Wood)\n    - Filescom\n      - Fix missing MD5 hash after uploading a file (Nick\n        Craig-Wood)\n    - FTP\n      - Fix incorrect modtime after uploading a file or setting its\n        modtime (Nick Craig-Wood)\n    - Googlephotos\n      - Warn in config wizard before using the shared client_id\n        (Nick Craig-Wood)\n    - Hasher\n      - Fix Update not storing hashes in bolt DB after file\n        replacement (Nick Craig-Wood)\n    - Hdfs\n      - Fix incorrect modtime after uploading a file or setting its\n        modtime (Nick Craig-Wood)\n    - Hidrive\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n    - HTTP\n      - Don't list parent directory when pointing at a single file\n        (Nick Craig-Wood)\n      - Add Prefer to CORS Access-Control-Allow-Headers header\n        (sijie-Z)\n    - Iclouddrive\n      - Fix \"cannot unmarshal number\" error when listing photo\n        albums (Nick Craig-Wood)\n      - Fix 2FA failing with 409 even when the code is valid (Punya\n        Jain)\n    - Imagekit\n      - Fix Open with a RangeOption returning the wrong data (Nick\n        Craig-Wood)\n      - Add mtime to the available metadata (Nick Craig-Wood)\n    - Internxt\n      - Add Move and DirMove methods for server-side file and\n        directory operations (jzunigax2)\n      - Handle file size limit errors during uploads (jzunigax2)\n      - Surface re-login error when re-auth fails in NewFs\n        (0rangeSeaW0lf)\n    - Jottacloud\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n    - Linkbox\n      - Retry bot protection HTML challenge responses instead of\n        failing (Nick Craig-Wood)\n    - Mailru\n      - Fix incorrect modtime after updating a file or setting its\n        modtime (Nick Craig-Wood)\n    - Mega\n      - Fix files reappearing in listings after being renamed (Nick\n        Craig-Wood)\n      - Fix moved files disappearing from listings between remotes\n        (Nick Craig-Wood)\n    - Netstorage\n      - Fix missing MD5 hash after uploading a file (Nick\n        Craig-Wood)\n    - Onedrive\n      - Add support for no admin mode (TaterLi)\n      - Treat non-2xx preauth download as error (ifloppy)\n      - Download malware-flagged files via Graph Prefer header\n        (ifloppy)\n    - Opendrive\n      - Fix uploaded objects returning the wrong hash and modtime\n        (Nick Craig-Wood)\n    - Oracleobjectstorage\n      - Fix crash when downloading objects with unknown length\n        (Nick Craig-Wood)\n      - Add --oos-decompress flag to download gzip-encoded files\n        (Nick Craig-Wood)\n    - Pixeldrain\n      - Fix incorrect modtime and missing hash after uploading a\n        file (Nick Craig-Wood)\n    - Protondrive\n      - Implement proper retry logic (tomholford)\n      - Fix gopenpgp: invalid data: user ID signature with wrong\n        type on custom-domain account (Nick Craig-Wood)\n      - Fix long hangs on permanent validation failures (Nick\n        Craig-Wood)\n      - Fix incorrect modtime after uploading a file (Nick\n        Craig-Wood)\n    - Putio\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n      - Fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT\n        errors (Nick Craig-Wood)\n    - Quatrix\n      - Fix incorrect modtime after uploading a file (Nick\n        Craig-Wood)\n    - S3\n      - Add Zero Services (ZERO-Z3) provider (Zero Services GmbH)\n      - Add Scality (RING / ARTESCA) provider (Dzmitry Nianakhau)\n    - Seafile\n      - Fix rclone sync files with identical size again and again\n        (TowyTowy)\n    - SFTP\n      - Add --sftp-pin-host-key - Trust On First Use host key\n        pinning (Nick Craig-Wood)\n      - Add --sftp-encoding support (Puneet Dixit)\n      - Don't retry permanent connection errors (Nick Craig-Wood)\n      - Allow silencing no hostkey validation warning (Noah Zalev)\n      - Fix cmd shell execution of paths containing\n        variable-expansion or newline characters (Nick Craig-Wood)\n    - Shade\n      - Retry server errors instead of failing the transfer (Nick\n        Craig-Wood)\n      - Fix uploads failing with EOF when completing multipart\n        uploads (Nick Craig-Wood)\n    - Smb\n      - Fix Kerberos credentials being reloaded for every\n        connection (Nick Craig-Wood)\n      - Fix TCP connection leak when connection setup fails (Nick\n        Craig-Wood)\n      - Fix server-side move of directories with special characters\n        in the name (Nick Craig-Wood)\n      - Fix spurious \"Directory already exists\" errors when moving\n        directories (Nick Craig-Wood)\n    - Ulozto\n      - Fix server side moves between differently rooted remotes\n        losing files (Nick Craig-Wood)\n    - WebDAV\n      - Fix incorrect modtime after setting a file's modtime (Nick\n        Craig-Wood)\n    - Yandex\n      - Fix 500 errors by waiting for uploads to complete before\n        setting modtime (Nick Craig-Wood)\n      - Fix missing MD5 hash after uploading a file (Nick\n        Craig-Wood)\n      - Fix modtime randomly reverting to the upload time after\n        upload (Nick Craig-Wood)\n      - Add --yandex-upload-wait to fix 500 errors when uploading\n        (Nick Craig-Wood)\n    - Zoho\n      - Honour Retry-After header on 429 (Erol Ozcan)\n      - Add --zoho-tpslimit and --zoho-tpslimit-burst (Erol Ozcan)\n      - Log throttling once per episode at NOTICE (Erol Ozcan)\n      - Rate limit repeated listings of the same folder (Erol\n        Ozcan)\n      - Fix flaky folder list limiter test under concurrent\n        listings (Nick Craig-Wood)\n      - Fix large file overwrite creating a duplicate instead of\n        replacing (Erol Ozcan)\n      - Treat R008 unauthorized as directory not found (Erol Ozcan)\n      - Preserve root_folder_id on reconnect and allow setting it\n        (Erol Ozcan)\n","status":"published","published":"2026-09-28T15:31:12Z","modified":"2026-10-01T18:23:12.143628024Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:15:27Z","modified":"2026-10-09T17:23:14.415693669Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22064-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278614).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).\n- Verification bypass via public key in legacy bundle (bsc#1282542).\n\nChanges for cosign:\n\n- update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):\n * This release resolves GHSA-fx35-mq7g-6g98, a verification\n bypass using an unexpected public key in a legacy bundle.\n * Auto-detect default digest algorithm for public keys\n * fix(pkcs11key): return an error instead of panicking when no\n key pair matches\n * Supporting OCI Signing with X.509 Certificate Chain\n * test(inspect): replace mock TSA client usage with local\n timestamp response generator in\n * fix: prevent shell completions for various options not taking\n filenames\n * fix(blob): compare file checksums case-insensitively in\n * Verification bypass via public key in legacy bundle (GHSA-\n fx35-mq7g-6g98)\n","status":"published","published":"2026-10-09T06:33:57Z","modified":"2026-10-19T17:23:11.640294525Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23692-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:28:52Z","modified":"2026-09-29T18:23:12.31116925Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23712-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260902T191204 2026-09-02T19:12:04Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6305 CVE-2026-55834 GHSA-2wvm-8mvp-22qv\n * GO-2026-6306 CVE-2026-55064 GHSA-44v6-7fxq-vgf4\n * GO-2026-6307 CVE-2026-55067 GHSA-569v-q83c-3j3g\n * GO-2026-6308 CVE-2026-55066 GHSA-5pg6-m483-7vrg\n * GO-2026-6309 CVE-2026-54746 GHSA-8x7x-83cf-c3pg\n * GO-2026-6310 CVE-2026-54755 GHSA-cgc5-v3f2-8m2v\n * GO-2026-6311 CVE-2026-54766 GHSA-f27p-pw2p-9pr4\n * GO-2026-6312 CVE-2026-55108 GHSA-fmgp-q6jx-gg3x\n * GO-2026-6313 CVE-2026-55065 GHSA-gg93-x632-9ccv\n * GO-2026-6314 CVE-2026-55569 GHSA-mf5c-hw34-4hpp\n * GO-2026-6315 CVE-2026-54754 GHSA-p7gw-2pcp-5pf8\n * GO-2026-6316 CVE-2026-55068 GHSA-x8mj-6p3q-g5pp\n * GO-2026-6317 CVE-2026-55588 GHSA-298f-872v-2rcx\n * GO-2026-6318 CVE-2026-55621 GHSA-64f3-v33m-w89f\n * GO-2026-6319 CVE-2026-55622 GHSA-c9f5-j9c3-mhrg\n * GO-2026-6320 CVE-2026-55245 GHSA-w98g-5w9p-p3rc\n * GO-2026-6321 CVE-2026-55484 GHSA-hr6j-w4mw-g9mj\n * GO-2026-6322 CVE-2026-55678 GHSA-p378-jp5r-gpgw\n * GO-2026-6323 CVE-2026-55763 GHSA-v358-wf77-39xv\n * GO-2026-6324 CVE-2026-55761 GHSA-x626-fcwx-f5pc\n * GO-2026-6325 CVE-2026-27878 GHSA-6xff-cpcq-vpw2\n * GO-2026-6326 CVE-2026-55784 GHSA-334q-h5g3-fpxv\n * GO-2026-6327 CVE-2026-55874 GHSA-56wq-x3wv-3ff4\n * GO-2026-6328 CVE-2026-55785 GHSA-fp46-6vfw-gc9c\n * GO-2026-6329 CVE-2026-55873 GHSA-hgpf-8634-g44c\n * GO-2026-6330 CVE-2026-55764 GHSA-mrpp-v6pg-p54x\n * GO-2026-6333 CVE-2026-25712 GHSA-37w2-86g3-h4qh\n * GO-2026-6334 CVE-2026-24690 GHSA-47rq-xp99-92mx\n * GO-2026-6335 CVE-2026-27657 GHSA-4c8f-3m6h-m56r\n * GO-2026-6336 CVE-2026-26232 GHSA-5v69-g2m3-3hq3\n * GO-2026-6337 CVE-2026-28705 GHSA-7jvx-g65v-r899\n * GO-2026-6338 CVE-2026-22547 GHSA-922f-hfwp-p56f\n * GO-2026-6339 CVE-2026-20909 GHSA-fhq3-p242-2qpf\n * GO-2026-6340 CVE-2026-25718 GHSA-h697-89cp-24q8\n * GO-2026-6341 CVE-2026-26307 GHSA-h9c5-x7g8-4q7f\n * GO-2026-6342 CVE-2026-26247 GHSA-m5ch-ppfx-xv3v\n * GO-2026-6354 CVE-2026-78662\n * GO-2026-6355 CVE-2026-56855\n\n- Update to version 0.0.20260828T144745 2026-08-28T14:47:45Z.\n\n * GO-2026-6303 CVE-2026-56854\n","status":"published","published":"2026-09-08T16:28:52Z","modified":"2026-09-29T18:23:12.805639295Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23736-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-14T09:33:48Z","modified":"2026-09-27T18:23:09.684187591Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23739-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260908.00\n","status":"published","published":"2026-09-15T06:54:33Z","modified":"2026-09-27T18:23:09.724146769Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23745-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260264).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n","status":"published","published":"2026-09-17T07:24:14Z","modified":"2026-09-27T18:23:10.770303667Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23831-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-14T09:47:52Z","modified":"2026-09-27T18:23:14.42755251Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23841-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issue:\n\n- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n","status":"published","published":"2026-09-15T07:07:31Z","modified":"2026-09-27T18:23:15.336463615Z","updated_at":"2026-11-02T15:54:03.991985Z"}]},"sources_more":{"osv":20}}