{"id":"CVE-2026-84303","aliases":["AZL-99696","DEBIAN-CVE-2026-84303","EUVD-2026-69419","GHSA-qc2q-p7wx-3px3","GO-2026-6441","SUSE-SU-2026:23506-1","SUSE-SU-2026:23546-1","SUSE-SU-2026:23548-1","SUSE-SU-2026:23688-1","SUSE-SU-2026:23708-1","SUSE-SU-2026:23729-1","SUSE-SU-2026:23730-1","SUSE-SU-2026:23736-1","SUSE-SU-2026:23739-1","SUSE-SU-2026:23831-1","SUSE-SU-2026:23852-1","SUSE-SU-2026:23855-1","SUSE-SU-2026:23863-1","SUSE-SU-2026:23864-1","SUSE-SU-2026:24150-1","SUSE-SU-2026:4062-1","SUSE-SU-2026:4125-1","SUSE-SU-2026:4175-1","SUSE-SU-2026:4178-1","SUSE-SU-2026:4206-1","SUSE-SU-2026:4270-1","SUSE-SU-2026:4272-1","SUSE-SU-2026:4292-1","SUSE-SU-2026:4293-1","SUSE-SU-2026:4308-1","SUSE-SU-2026:4388-1","SUSE-SU-2026:4389-1","SUSE-SU-2026:4444-1","SUSE-SU-2026:4628-1","SUSE-SU-2026:5167-1","UBUNTU-CVE-2026-84303","openSUSE-SU-2026:11686-1","openSUSE-SU-2026:11695-1","openSUSE-SU-2026:11697-1","openSUSE-SU-2026:11700-1","openSUSE-SU-2026:11713-1","openSUSE-SU-2026:11718-1","openSUSE-SU-2026:11731-1","openSUSE-SU-2026:11732-1","openSUSE-SU-2026:11743-1","openSUSE-SU-2026:11752-1","openSUSE-SU-2026:11830-1","openSUSE-SU-2026:11837-1","openSUSE-SU-2026:11853-1","openSUSE-SU-2026:11920-1","openSUSE-SU-2026:12114-1","openSUSE-SU-2026:12241-1","openSUSE-SU-2026:12375-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21809-1","openSUSE-SU-2026:21824-1","openSUSE-SU-2026:21834-1","openSUSE-SU-2026:21841-1","openSUSE-SU-2026:21843-1","openSUSE-SU-2026:21879-1","openSUSE-SU-2026:21882-1","openSUSE-SU-2026:21886-1","openSUSE-SU-2026:21897-1","openSUSE-SU-2026:21898-1","openSUSE-SU-2026:21927-1","openSUSE-SU-2026:21996-1","openSUSE-SU-2026:22035-1","openSUSE-SU-2026:22134-1","openSUSE-SU-2026:22221-1","openSUSE-SU-2026:22224-1"],"status":"published","title":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00311,"percentile":0.24267,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178","CWE-863"],"published":"2026-09-01T18:14:37Z","modified":"2026-11-11T13:00:04Z","fixes":[{"ecosystem":"Go","package":"google.golang.org/grpc","fixed_in":["1.83.1"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"v2ray-core","fixed_in":["5.54.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"google.golang.org/grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.83.0"},{"fixed":"1.83.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.62.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.3-2","1.38.0+really1.33.3-1","1.38.0-1","1.38.0-2","1.38.0-3","1.38.0-4","1.38.0-5","1.38.1-1","1.59.0-1","1.60.1-1","1.60.1-2","1.64.0-1","1.64.0-2","1.64.0-3","1.64.0-4","1.64.0-5","1.64.0-6","1.64.0-7","1.66.3-1","1.66.3-2","1.75.1-1","1.79.3-1","1.79.3-1~bpo13+1","1.81.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.64.0-7","1.66.3-1","1.66.3-2","1.75.1-1","1.79.3-1","1.79.3-1~bpo13+1","1.81.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.64.0-7","1.66.3-1","1.66.3-2","1.75.1-1","1.79.3-1","1.79.3-1~bpo13+1","1.81.1-1"]},{"source":"osv","ecosystem":"Go","package":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.83.1"}]}]},{"source":"osv","ecosystem":"Go","package":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.83.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-slfo.1.1_3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"azure-storage-azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.8-150400.9.21.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-150000.1.96.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-6.81.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-150100.3.87.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-150100.3.87.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-150100.3.87.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-150100.3.87.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-150000.1.85.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-1.75.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-1.60.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-150000.1.67.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.4.43.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300072.0-150400.9.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300072.0-150400.9.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300072.0-150400.9.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300072.0-150400.9.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.29.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.34.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.23.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.30.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.32.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.26.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.42.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20150514.0.f5ebd86-1","0.0~git20150514.0.f5ebd86-2","0.0~git20151002.0.3e7b7e5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1","20240716.00-0ubuntu1~16.04.0+esm2","20240716.00-0ubuntu1~16.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.2-1","0.11.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.4-1","1.6.0-2","1.6.0-3","1.6.0-3ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0+esm1","20241011.01-0ubuntu1~18.04.0+esm2","20241011.01-0ubuntu1~18.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-1","1.3.2-1ubuntu1","1.3.2-1.1~build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0","20250116.00-0ubuntu1~20.04.0+esm1","20250116.00-0ubuntu1~20.04.0+esm2","20250116.00-0ubuntu1~20.04.0+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","1.16.1-1ubuntu1","1.16.1-1ubuntu3","1.16.1-1ubuntu4","1.16.1-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.1","20250116.00-0ubuntu1~22.04.2","20250116.00-0ubuntu1~22.04.3","20250116.00-0ubuntu1~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30.2-3","1.30.2-3build1","1.30.2-3build3","1.30.2-3build5","1.30.2-3build6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1","20250116.00-0ubuntu1~24.04.2","20250116.00-0ubuntu1~24.04.3","20250116.00-0ubuntu1~24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-3build3","1.51.1-3build4","1.51.1-4","1.51.1-4build1","1.51.1-4build2","1.51.1-4.1build3","1.51.1-4.1build4","1.51.1-4.1build5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.66.3-2","1.81.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250506.01-0ubuntu2","20250506.01-0ubuntu3","20260819.00+~20260819.00-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-8ubuntu1","1.51.1-9","1.51.1-9ubuntu3","1.51.1-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-google-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.64.0-7","1.66.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20250506.01-0ubuntu1","20250506.01-0ubuntu2","20250506.01-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-6build1","1.51.1-7","1.51.1-7ubuntu2","1.51.1-7ubuntu3","1.51.1-8ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.5-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.66","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.66.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260908.00-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.11-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-7.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-160000.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-160000.3.1"}]}],"bundled":39},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-bp160.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cadvisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.5-bp160.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260903.01-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260911.00-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-160000.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"distribution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-160000.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp160.4.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54.2-bp160.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-bp160.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"warewulf4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-bp160.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.6-bp160.1.1"}]}],"bundled":6}],"products":[{"vendor":"grpc","product":"grpc-go"}],"references":[{"url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/grpc/grpc-go/pull/9332","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/grpc/grpc-go/pull/9335","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/grpc/grpc-go/releases/tag/v1.83.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84303","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qc2q-p7wx-3px3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84303.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84303","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-go","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623506-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1272402","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1276644","tags":["report"]},{"url":"https://bugzilla.suse.com/1277949","tags":["report"]},{"url":"https://bugzilla.suse.com/1278270","tags":["report"]},{"url":"https://bugzilla.suse.com/1278273","tags":["report"]},{"url":"https://bugzilla.suse.com/1278688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623546-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623548-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272118","tags":["report"]},{"url":"https://bugzilla.suse.com/1278967","tags":["report"]},{"url":"https://bugzilla.suse.com/1279297","tags":["report"]},{"url":"https://bugzilla.suse.com/1279414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623688-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623708-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210938","tags":["report"]},{"url":"https://bugzilla.suse.com/1272128","tags":["report"]},{"url":"https://bugzilla.suse.com/1278987","tags":["report"]},{"url":"https://bugzilla.suse.com/1279201","tags":["report"]},{"url":"https://bugzilla.suse.com/1279304","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623729-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623730-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253357","tags":["report"]},{"url":"https://bugzilla.suse.com/1278597","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623831-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623852-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268884","tags":["report"]},{"url":"https://bugzilla.suse.com/1276677","tags":["report"]},{"url":"https://bugzilla.suse.com/1277966","tags":["report"]},{"url":"https://bugzilla.suse.com/1278997","tags":["report"]},{"url":"https://bugzilla.suse.com/1279219","tags":["report"]},{"url":"https://bugzilla.suse.com/1279316","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623855-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88046","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623863-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623864-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624150-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276744","tags":["report"]},{"url":"https://bugzilla.suse.com/1279231","tags":["report"]},{"url":"https://bugzilla.suse.com/1279329","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264062-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278267","tags":["report"]},{"url":"https://bugzilla.suse.com/1278269","tags":["report"]},{"url":"https://bugzilla.suse.com/1278272","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276733","tags":["report"]},{"url":"https://bugzilla.suse.com/1279026","tags":["report"]},{"url":"https://bugzilla.suse.com/1279223","tags":["report"]},{"url":"https://bugzilla.suse.com/1279330","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264175-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264178-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264206-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264270-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264272-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264292-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276722","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264293-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264308-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278666","tags":["report"]},{"url":"https://bugzilla.suse.com/1279033","tags":["report"]},{"url":"https://bugzilla.suse.com/1279236","tags":["report"]},{"url":"https://bugzilla.suse.com/1279333","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264388-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279235","tags":["report"]},{"url":"https://bugzilla.suse.com/1279334","tags":["report"]},{"url":"https://bugzilla.suse.com/1279393","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264389-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264444-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280841","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88922","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://bugzilla.suse.com/1276980","tags":["report"]},{"url":"https://bugzilla.suse.com/1276990","tags":["report"]},{"url":"https://bugzilla.suse.com/1278462","tags":["report"]},{"url":"https://bugzilla.suse.com/1278477","tags":["report"]},{"url":"https://bugzilla.suse.com/1278505","tags":["report"]},{"url":"https://bugzilla.suse.com/1278742","tags":["report"]},{"url":"https://bugzilla.suse.com/1278743","tags":["report"]},{"url":"https://bugzilla.suse.com/1278751","tags":["report"]},{"url":"https://bugzilla.suse.com/1279080","tags":["report"]},{"url":"https://bugzilla.suse.com/1279137","tags":["report"]},{"url":"https://bugzilla.suse.com/1279243","tags":["report"]},{"url":"https://bugzilla.suse.com/1279245","tags":["report"]},{"url":"https://bugzilla.suse.com/1279263","tags":["report"]},{"url":"https://bugzilla.suse.com/1279386","tags":["report"]},{"url":"https://bugzilla.suse.com/1280175","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265167-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278574","tags":["report"]},{"url":"https://bugzilla.suse.com/1278869","tags":["report"]},{"url":"https://bugzilla.suse.com/1279184","tags":["report"]},{"url":"https://bugzilla.suse.com/1279276","tags":["report"]},{"url":"https://bugzilla.suse.com/1285255","tags":["report"]},{"url":"https://bugzilla.suse.com/1286984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287039","tags":["report"]},{"url":"https://bugzilla.suse.com/1287131","tags":["report"]},{"url":"https://bugzilla.suse.com/1287260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-84303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84303","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://bugzilla.suse.com/1238699","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241838","tags":["report"]},{"url":"https://bugzilla.suse.com/1248946","tags":["report"]},{"url":"https://bugzilla.suse.com/1251495","tags":["report"]},{"url":"https://bugzilla.suse.com/1251689","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1260295","tags":["report"]},{"url":"https://bugzilla.suse.com/1262269","tags":["report"]},{"url":"https://bugzilla.suse.com/1262952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265799","tags":["report"]},{"url":"https://bugzilla.suse.com/1266179","tags":["report"]},{"url":"https://bugzilla.suse.com/1266639","tags":["report"]},{"url":"https://bugzilla.suse.com/1267176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272064","tags":["report"]},{"url":"https://bugzilla.suse.com/1276687","tags":["report"]},{"url":"https://bugzilla.suse.com/1278621","tags":["report"]},{"url":"https://bugzilla.suse.com/1279234","tags":["report"]},{"url":"https://bugzilla.suse.com/1279315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://bugzilla.suse.com/1265425","tags":["report"]},{"url":"https://bugzilla.suse.com/1278584","tags":["report"]},{"url":"https://bugzilla.suse.com/1278934","tags":["report"]},{"url":"https://bugzilla.suse.com/1279296","tags":["report"]},{"url":"https://bugzilla.suse.com/1279416","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://bugzilla.suse.com/1279044","tags":["report"]},{"url":"https://bugzilla.suse.com/1279224","tags":["report"]},{"url":"https://bugzilla.suse.com/1279320","tags":["report"]},{"url":"https://bugzilla.suse.com/1278853","tags":["report"]},{"url":"https://bugzilla.suse.com/1279274","tags":["report"]},{"url":"https://bugzilla.suse.com/1279396","tags":["report"]},{"url":"https://bugzilla.suse.com/1266787","tags":["report"]},{"url":"https://bugzilla.suse.com/1278801","tags":["report"]},{"url":"https://bugzilla.suse.com/1279262","tags":["report"]},{"url":"https://bugzilla.suse.com/1279411","tags":["report"]},{"url":"https://bugzilla.suse.com/1271215","tags":["report"]},{"url":"https://bugzilla.suse.com/1276707","tags":["report"]},{"url":"https://bugzilla.suse.com/1276755","tags":["report"]},{"url":"https://bugzilla.suse.com/1278962","tags":["report"]},{"url":"https://bugzilla.suse.com/1279208","tags":["report"]},{"url":"https://bugzilla.suse.com/1279310","tags":["report"]},{"url":"https://bugzilla.suse.com/1283727","tags":["report"]},{"url":"https://bugzilla.suse.com/1285291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72924","tags":["web"]},{"url":"https://bugzilla.suse.com/1278760","tags":["report"]},{"url":"https://bugzilla.suse.com/1279257","tags":["report"]},{"url":"https://bugzilla.suse.com/1266544","tags":["report"]},{"url":"https://bugzilla.suse.com/1278793","tags":["report"]},{"url":"https://bugzilla.suse.com/1279102","tags":["report"]},{"url":"https://bugzilla.suse.com/1279253","tags":["report"]},{"url":"https://bugzilla.suse.com/1280657","tags":["report"]},{"url":"https://bugzilla.suse.com/1283555","tags":["report"]},{"url":"https://bugzilla.suse.com/1286934","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-84303","title":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T18:14:37.87Z","modified":"2026-09-02T19:14:49.353Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-178","CWE-863"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-69419","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T18:14:37Z","modified":"2026-09-02T19:14:49Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-qc2q-p7wx-3px3","title":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","description":"### Summary\nA vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).\n\n### Impact\nWhen an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.\n\nFurthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.\n\n### Patches\nThe problem is fixed in `master` and in the 1.83.1 release.","status":"published","published":"2026-09-08T20:50:21Z","modified":"2026-09-08T20:50:23Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-178","CWE-863"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-84303","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T19:17:30.6Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-178","CWE-863"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-84303","title":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T18:14:37.87Z","modified":"2026-11-11T13:12:16.002644821Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-178","CWE-863"],"updated_at":"2026-11-11T13:40:09.010523Z"},{"id":"DEBIAN-CVE-2026-84303","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T19:17:30.6Z","modified":"2026-10-01T03:03:43.984922888Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-qc2q-p7wx-3px3","title":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","description":"### Summary\nA vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).\n\n### Impact\nWhen an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.\n\nFurthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.\n\n### Patches\nThe problem is fixed in `master` and in the 1.83.1 release.","status":"published","published":"2026-09-08T20:50:21Z","modified":"2026-09-15T19:10:32.558419529Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-178","CWE-863"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"UBUNTU-CVE-2026-84303","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T19:17:00Z","modified":"2026-11-11T09:41:11.782211685Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-11T10:03:16.170826Z"},{"id":"AZL-99696","title":"CVE-2026-84303 affecting package grpc 1.62.3-1","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","status":"published","published":"2026-09-01T19:17:30Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"GO-2026-6441","title":"Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc","description":"In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking \"grpc-\" prefixed headers and \":scheme\" via variations in casing.","status":"published","published":"2026-09-15T18:39:25Z","modified":"2026-09-15T19:00:17.130575881Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:11686-1","title":"helm3-3.21.3-8.1 on GA media","description":"These are all security issues fixed in the helm3-3.21.3-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:04.470936077Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11695-1","title":"cadvisor-0.60.5-3.1 on GA media","description":"These are all security issues fixed in the cadvisor-0.60.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:04.84647486Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11697-1","title":"distribution-registry-3.1.1-6.1 on GA media","description":"These are all security issues fixed in the distribution-registry-3.1.1-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.528369322Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11700-1","title":"hauler-2.1.0-3.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:06.479257948Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11713-1","title":"trivy-0.74.0-4.1 on GA media","description":"These are all security issues fixed in the trivy-0.74.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.268369822Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11718-1","title":"helm-4.2.4-3.1 on GA media","description":"These are all security issues fixed in the helm-4.2.4-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:05.699036592Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11731-1","title":"containerized-data-importer1.65-api-1.65.0-3.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:22.462847721Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11732-1","title":"containerized-data-importer1.66-api-1.66.1-1.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.66-api-1.66.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:18.656014419Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11743-1","title":"google-osconfig-agent-20260908.00-1.1 on GA media","description":"These are all security issues fixed in the google-osconfig-agent-20260908.00-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-09-11T18:23:07.941316336Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11752-1","title":"kubevirt1.9-container-disk-1.9.0-3.1 on GA media","description":"These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.339908969Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11830-1","title":"apptainer-1.5.3-4.1 on GA media","description":"These are all security issues fixed in the apptainer-1.5.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:08.566829939Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11837-1","title":"mcphost-0.34.0-11.1 on GA media","description":"These are all security issues fixed in the mcphost-0.34.0-11.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:09.513903952Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11853-1","title":"golang-github-v2fly-v2ray-core-5.54.2-1.1 on GA media","description":"These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.54.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-09-23T09:15:06.602401348Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:11920-1","title":"grafana-12.4.11-1.1 on GA media","description":"These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:14.025740075Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:09.124869157Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12241-1","title":"kubevirt1.8-container-disk-1.8.4-7.1 on GA media","description":"These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:09.36502555Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12375-1","title":"warewulf4-4.7.1-2.1 on GA media","description":"These are all security issues fixed in the warewulf4-4.7.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-31T00:00:00Z","modified":"2026-11-01T11:30:04.850816379Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA\n  certificates (bsc#1258543).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278624).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279390).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1279392).\n","status":"published","published":"2026-09-07T15:03:57Z","modified":"2026-09-10T18:23:46.123242111Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21809-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.21.1:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-08T14:29:32Z","modified":"2026-09-10T18:23:23.371750044Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","description":"This update for containerized-data-importer1.65 fixes the following issues:\n\n- CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241838).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251495).\n- CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or\n  (bsc#1253506).\n- CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).\n- CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).\n- CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251689).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267176).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260295).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265799).\n- CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262952).\n- CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service\n  (bsc#1262269).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266639).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,\n  CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276687).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272064).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278621).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279315).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279234).\n","status":"published","published":"2026-09-09T15:12:11Z","modified":"2026-09-12T18:23:08.1084477Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21834-1","title":"Security update for google-cloud-sap-agent","description":"This update for google-cloud-sap-agent fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279304).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278987).\n\nNon security issue fixed:\n\n- re-enable stripping and debuginfo (bsc#1210938).\n","status":"published","published":"2026-09-14T08:32:36Z","modified":"2026-09-15T17:00:06.092054781Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21841-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor.tar to fix:\n\n  * bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662:\n    hauler: golang.org/x/crypto/ssh: authentication bypass and\n    deadlocks in the crypto/ssh library\n\n- update vendor.tar to fix:\n\n  * bsc#1279416, CVE-2026-84304\n  * bsc#1279296, CVE-2026-84303\n  * bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via\n    crash due to missing ':authority' and 'Host' headers\n\nUpdate to 2.1.0 (bsc#1265425, CVE-2026-41888).\n","status":"published","published":"2026-09-14T13:24:33Z","modified":"2026-09-15T17:00:06.103421664Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21843-1","title":"Security update for cadvisor","description":"This update for cadvisor fixes the following issues:\n\nChanges in cadvisor:\n\nupdate vendor.tar to fix:\n\n  * bsc#1279044, CVE-2026-84445\n  * bsc#1279224, CVE-2026-84304\n  * bsc#1279320, CVE-2026-84303: cadvisor: google.golang.org/grpc:\n    xDS RBAC HTTP filter implementation issue allows for bypass\n    of authorization policies\n","status":"published","published":"2026-09-14T13:26:27Z","modified":"2026-09-15T17:00:06.197590358Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21879-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-18T07:48:05Z","modified":"2026-09-25T18:23:10.631355474Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21882-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276722).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260911.00\n * Add support for all possible SCALIBR os extractor for linux (#1052)\n * Migrate presubmits from deb11 to deb12 (#1050)\n * Bump the go_modules group across 1 directory with 3 updates (#1047)\n * Introduce E2E v2 framework and inventory tests (#1039)\n * Remove test case for asserting JSON marshal error from task_state.go (#1045)\n * security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)\n * Add Configuration for SCALIBR (#1034)\n * add CheckState and Cleanup tests (#1008)\n * Improve unit tests for osinfo/osinfo_linux.go (#1020)\n * Bump github.com/go-git/go-git/v5 (#1036)\n * Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)\n * Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)\n * authenticate cloud build to use docker registry (#1030)\n * Migrate e2e build to internal image (#1024)\n * Upgrade google.golang.org/grpc to new version. (#1023)\n * Improve unit tests for ospatch/yum_update.go (#1012)\n * Improve unit tests for ospatch/updates.go (#1011)\n * Add unit tests for config/package_resource.go PART 2 (#1005)\n * Add unit tests for config/package_resource.go PART 1 (#1003)\n * Add unit tests for policies/local.go (#1015)\n * Add unit tests for repository_resource.go (#1002)\n * Add unit tests for installrecipe.go part 2 (#993)\n * Add unit tests for scalibr.go (#1019)\n * Add unit tests for installrecipe.go part 1 (#992)\n * Add test cases for policies/recipes/recipedb.go (#989)\n * Bump golang.org/x/crypto (#1021)\n * Add unit tests for policies/recipes/steps.go PART 3 (#976)\n * Add unit tests for policies/recipes/steps.go PART 2 (#975)\n * Bump golang.org/x/net (#1017)\n * upgrade x/net package. (#1018)\n * Add test cases for config/file_resource.go (#988)\n * Add unit tests for policies/recipes/artifacts.go (#985)\n * Add unit tests for policies/recipes/steps.go PART 1 (#974)\n * Add tests \u0026 bugfix for packages/trace.go (#939)\n * Add unit tests for agentendpoint/agentendpoint_beta.go (#983)\n * Replace yum install with yum update (#1009)\n * Bump github.com/containerd/containerd (#1013)\n * Add unit tests for policies/apt.go PART 2 (#957)\n * Add test cases for agentendpoint/task_state.go (#984)\n * Remove deprecated rhel-sap images and add new ones (#1007)\n * Add test cases for clog/clog.go (#986)\n","status":"published","published":"2026-09-19T22:39:23Z","modified":"2026-09-25T18:23:10.631636068Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21886-1","title":"Security update for mcphost","description":"This update for mcphost fixes the following issues:\n\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279274).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279396).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278853).\n","status":"published","published":"2026-09-20T04:09:14Z","modified":"2026-09-25T18:23:11.430190655Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21897-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:36:27Z","modified":"2026-09-25T18:23:11.534555779Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21898-1","title":"Security update for distribution","description":"This update for distribution fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278997).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276677).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279316).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278997).\n","status":"published","published":"2026-09-21T12:26:04Z","modified":"2026-09-25T18:23:11.823190119Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21927-1","title":"Security update for apptainer","description":"This update for apptainer fixes the following issues:\n\nChanges in apptainer:\n\n- Fix potential authentication bypass and deadlocks in the\n  crypto/ssh library by updating golang.org/x/crypto to v0.56.0.\n  CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)\n- Fix\n  * a potential DoS via crash due to missing ':authority' and\n    'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),\n  * a potential heap memory exhaustion via HTTP/2 DATA frame\n     fragmentation CVE-2026-84304 (bsc#1279236),\n  * a potential bypass of authorization policies via mixed-case\n    or canonical-case header matches due to an xDS RBAC HTTP filter\n    implementation issue CVE-2026-84303 (bsc#1279333)\n  by updating google.golang.org/grpc to v1.83.2\n","status":"published","published":"2026-09-21T13:53:22Z","modified":"2026-09-25T18:23:13.330991497Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21996-1","title":"Security update for v2ray-core","description":"This update for v2ray-core fixes the following issues:\n\nChanges in v2ray-core:\n\n- Update version to 5.54.2\n  * Add iOS Client Support Bundle: Packet Bridge Receiver, Subscription\n    Improvment, DNS and other udp improvement\n  * Add Wireguard Chain Proxy Support\n  * Fix bugs\n  * Update vendored dependencies (boo#1266787, CVE-2026-39821, boo#1278801, CVE-2026-84445,\n    boo#1279262, CVE-2026-84303, boo#1279411, CVE-2026-84304)\n\n- Update dlc.dat and geoip.dat\n","status":"published","published":"2026-09-28T13:48:29Z","modified":"2026-10-01T18:23:10.96161437Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22035-1","title":"Security update for amazon-ecs-init","description":"This update for amazon-ecs-init fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276744).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279329).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231).\n\nChanges for amazon-ecs-init:\n\n- Update to version 1.107.0\n * Feature - Add MPS GPU Sharing capability (#5139)\n * Enhancement - Add MPS control daemon health gate task resource\n (#5107)\n * Enhancement - Surface MPS control-daemon impairment reason\n as StatusReason (#5125)\n * Enhancement - Attach the MPS control daemon health gate to\n MPS tasks (#5119)\n * Enhancement - Add ACCELERATED_COMPUTE health check for the\n MPS control daemon (#5124)\n * Enhancement - Fetch GPG keys from S3 instead of GitHub in\n ECS Anywhere install script (#5130)\n * Enhancement - Bump github.com/prometheus/common from 0.66.1\n to 0.71.0 in /ecs-agent (#5117)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials\n from 1.19.32 to 1.20.4 in /agent (#5128)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.33\n to 1.7.35 in /ecs-init (#5133)\n * Enhancement - Bump google.golang.org/grpc from 1.82.1 to 1.83.1,\n this also updated go.opentelemetry.io/otel to v1.44.0\n in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5123)\n * Enhancement - Bump k8s.io/api from 0.28.1 to 0.37.0 in /agent (#5118)\n * Enhancement - Correct broken systemd link in README (#5129)\n * Enhancement - Bump golang.org/x/text and related dependencies (#5100)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds\n from 1.18.33 to 1.18.38 in /ecs-agent (#5093)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/secretsmanager\n from 1.35.2 to 1.44.7 in /agent (#5094)\n * Enhancement - Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3\n (#5108)\n * Enhancement - Update Go version to 1.26.7 (#5105)\n * Enhancement - Add amazon-ecs-agent.gpg and amazon-ssm-agent.gpg\n to the CodePipeline release artifacts (#5101)\n * Enhancement - IMDS credentials scanner/refresher: Add logging\n and validations (#5091)\n * Enhancement - Bump github.com/containerd/cgroups/v3 from 3.0.4\n to 3.1.3 in /agent (#5081)\n * Enhancement - Bump google.golang.org/grpc from 1.81.1 to 1.82.1\n in /ecs-agent and /agent (#5085)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from\n 1.19.29 to 1.19.32 in /ecs-agent, /agent and /ecs-init (#5080)\n * Bugfix - fix(handlers): raise fault rate limit to 1 rps (#5092)\n * Feature - Nvidia MPS GPU sharing (not yet enabled)\n * Add MPS control-daemon health probe (#5095)\n * Add per-GPU memory accounting to host resource manager (#5090)\n * Allow MPS containers to colocate on a shared GPU (#5083)\n * Mount MPS control binary and pipe dir into the agent container\n (#5086)\n * Move MPS pipe directory to /run/mps-ecs (#5102)\n * Enhancement - Add retry for EFS volume creation to handle plugin\n timeout errors caused by concurrent mount operation (#5077)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from\n 1.32.23 to 1.32.31 in /agent (#5064)\n * Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.82.1\n in /ecs-agent/daemonimages/csidriver (#5056)\n * Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1\n in /ecs-agent (#5063)\n * Enhancement - add nos3readcache S3 Files mount option (#5062)\n * Add ecs.capability.gpu-sharing-mps capability for NVIDIA MPS\n GPU sharing (#5053)\n * Inject NVIDIA MPS env vars and pipe mount into MPS containers\n (#5082)\n * Map ACS GPU sharingStrategy onto the internal container model\n for MPS (#5076)\n * Gate gpu-sharing-mps on complete per-GPU memory- (#5075) (#5075)\n * Regenerate ACS model for GPU sharingStrategy and validate it (#5071)\n * Report per-GPU memory at container instance registration\n for GPU sharing (#5061)\n * Regenerate ECS SDK with gpuInfo on PlatformDevice (#5060)\n","status":"published","published":"2026-10-06T14:54:50Z","modified":"2026-10-09T17:23:14.417092217Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22134-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.102.0, fixing four security issues\n  (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,\n  GHSA-wjmr-j3rp-mh2g):\n\n  * gh release/run/attestation download and repo read-file --output\n    could write to an unintended file through symbolic links\n  * gh attestation verify compared --source-ref case-insensitively\n  * gh attestation verify matched --signer-workflow only by prefix\n  * gh skill search could inject options into gh skill install\n  * Copy auth codes to the clipboard by default (gh config set\n    clipboard disabled to opt out)\n  * Remove the gh repo garden command and the multi-account migration\n  * Use API SSH URLs for repository clones\n  * Validate repository names during interactive creation\n  * Fix remote branch deletion on owner case mismatch\n  * Propagate the gh path to extensions\n  * Allow ghu_ tokens to attach files\n  * Allow gh repo set-default --unset without an argument\n  * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0,\n    github.com/klauspost/compress to 1.20.1 and Go to 1.27.1\n- Update golang.org/x/net to 0.60.0 to fix\n  excessive CPU consumption on repeated HTTP/2 initial window\n  changes (CVE-2026-78669, bsc#1285291).\n- Require golang(API) \u003e= 1.27 as upstream moved to Go 1.27.\n- Not affected, vendored dependencies are above the fixed version:\n  * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2\n  * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310):\n    grpc is 1.83.2, fixed in 1.83.1\n  * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in\n    1.44.0\n  * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1,\n    contains the fix of 1.18.7\n  * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed\n    version\n  * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last\n    affected version\n","status":"published","published":"2026-10-19T17:22:04Z","modified":"2026-10-20T19:15:03.960243328Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22221-1","title":"Security update for warewulf4","description":"This update for warewulf4 fixes the following issues:\n\nChanges in warewulf4:\n\n- Update google.golang.org/grpc to which fixes:\n  * CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278760)\n  * CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279257)\n","status":"published","published":"2026-11-03T10:56:01Z","modified":"2026-11-04T17:23:23.129148969Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"openSUSE-SU-2026:22224-1","title":"Security update for rqlite","description":"This update for rqlite fixes the following issues:\n\nChanges in rqlite:\n\n- Update to version 10.6.6:\n  * Keep the local auto-backup file if the metadata rename fails\n  * Reject local auto-backup filenames reserved for internal use\n  * POST /demote and POST /promote return a JSON error body, and\n    404 when the target node is not in the cluster.\n  * DELETE /remove returns a JSON error body.\n- Includes changes from  version 10.6.5:\n  * Guard the inter-node backup stream handler directly against a\n    missing backup request\n  * POST /leader returns a JSON error body, and 404 when the target\n    node is not in the cluster\n\n- Update to version 10.6.4:\n  * BACKUP_STREAM authorization failures can disclose the database\n    and crash rqlited (boo#1286934)\n  * GET /leader returns a JSON error body when there is no leader\n  * Close the connection after rejecting an unauthorized inter-node\n    backup stream request, instead of streaming the database anyway\n  * Decide inter-node command authorization once, before dispatch,\n    and close the connection after rejecting any unauthorized\n    command\n\n- Update to version 10.6.3:\n  * Node probes honor request context and commit exactly one\n    result\n  * Make DB connections a first-class object\n  * Prevent ATTACH on the query database connection\n\n- Update to version 10.6.2:\n  * Check for trailing junk in request bodies\n  * Console schema view handles table names that collide with\n    JavaScript object properties\n  * Set CommitTimestamps in CDC Events Group\n  * Upgrade dependencies\n\n- Update to version 10.6.1:\n  * Use constant-time comparison when comparing passwords\n  * Conditionally rewrite SQL during queued writes and fix\n    rewriting of CURRENT_TIMESTAMP and related tokens\n  * More robust Leader stepdown node ID detection, reap checks,\n    and SQL analyze start-time recording\n  * CDC fixes: encode non-finite floats, always release flush\n    waiters, and make the HTTP sink follow redirects\n  * Converted _service from mode=disabled to mode=manual (legacy\n    leftover; services are run by hand via osc service manualrun)\n  * Package is not affected by CVE-2026-84445 (boo#1278793),\n    CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):\n    vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes\n  * Package is not affected by CVE-2026-89090 (boo#1280657):\n    vendored eventstream is v1.7.20, above the v1.7.8 fix\n  * Package is not affected by CVE-2026-63209 (boo#1283555):\n    vendored klauspost/compress is v1.20.1, above the v1.18.7\n    fix\n  * Package is not affected by CVE-2026-39821 (boo#1266544):\n    vendored golang.org/x/net is v0.59.0, above the v0.55.0\n    fix\n\n- Update to version 10.6.0:\n  * API addition: error_v2 may contain numeric SQLite error codes.\n  * addresses a security issue related to Authentication files. A\n    user with no explicit permissions could be grant elevated\n    permissions. Correctly configured users do not suffer from this\n    issue.\n  * multiple implementation changes and bug fixes\n  * Display interactive cluster topology on web console.\n  * Support configurable queued-writes retries\n  * release addresses a gap in the role-based access permissions\n    related to change-data-capture (CDC) handling\n\n- Update to version 10.3.6:\n  * Add query logging to database layer\n  * Snapshot IDs now contain (optional) generation\n  * Bump generation ID if snapshot IDs collide\n  * Snapshots can be filtered by term and index\n  * Add support for File Renaming and Removing with retries\n  * Replace standard library with fsutil\n  * Keep snapshot ordering correct regardless of clock\n  * Remove snapshot name generation ID\n\n- Update to version 10.3.5:\n  * Reject alternate form of unsupported PRAGMA commands\n  * Handle negative trailing logs\n  * Sync access to last backup time at http layer\n  * Set the \"Served by\" header before first backup byte\n  * Set DB load response time for all formats\n  * Fix HTTP logic error for queued statements\n  * Minor web console fixes\n- includes changes from 10.0.4:\n  * Do not emit rolled-back events over CDC\n- includes changes from 10.0.3:\n  * Refactor busy timeout methods\n  * Fix edge-case bugs detected by GPT-6 Astra\n  * Switch to quay.io/minio/minio:latest for testing purposes\n  * Fix removing a node with different ID, but same Raft address\n  * Use correct Foreign Key setting when recovering node\n  * Only dump the indexes and triggers of the selected tables\n  * Detect DB changes during Request(RETURNING)\n  * Snapshot Open() first checks for failed reap\n  * Sync snapshot plan directory\n  * Propagate WAL stat errors\n  * Clean up cancelled snapshots\n  * Reject incomplete snapshot headers\n  * Validate restore database header\n  * Only reap a sole fullsnapshot if it has zero WALs\n  * Keep database dumps consistent during writes to the database\n  * Roll back DB Requests on statement-prepare errors\n- includes changes from 10.0.2:\n  * Upgrade SQLite driver\n  * Unit test reaping an installed Snapshot and streamed Snapshot combo\n  * Use distinct Snapshot Namer type\n  * Replace breaking-pragma regexes with ASCII prefix scanning\n  * Consolidate pragma and txStatus reads onto a single connection per pool\n  * Fix some magic strings in db package\n\n- Update to version 10.3.1:\n  * Consolidate SQLite driver construction\n  * Plumb Term and Index through during Snapshot Restore\n  * Hard exit if FSM Restore fails post database-swap\n\n- Update to version 10.3.0:\n  * Console app supports quickly querying for first 100 rows of a\n    table\n  * Rename read-only nodes to read replicas. Command-line flags\n    unchanged\n  * Bundles dependencies updated\n  * Add infra for pushing OTLP metrics to an OpenTelemetry\n    Collector\n  * Add query logging at database level\n  * Add CopyDir functionality to file utils.\n  * Add ability to clone Snapshots, primarily for testing purposes\n  * Store Index and Term in Fingerprint file and check during\n    start-up\n\n- Update to version 10.2.7:\n  * Remove explicit database-level read-only check from the pure\n    Query path\n  * Miscellaneous Store-level fixes related to resource management\n    and shutdown sequence\n  * Don't run CRC checks twice on Snapshot when fast-restart is\n    explicitly disabled\n  * Fixes to the http package including SQL rewriting control.\n  * Address potential dropped CDC event on restart\n  * Various minor fixes\n - includes changes from 10.2.6:\n  * Handle a fully-executed Reap plan, but Plan file itself not\n    removed\n  * Close Snapshot streamer on error.\n- includes changes from 10.2.5:\n  * Perform a Quick Integrity check after reaping snapshots, not\n    Full\n\n- Update to version 10.2.4:\n  * Fix some non-AWS S3-compatible stores\n- includes changes from 10.2.3\n  * Check snapshot store integrity before first actual use\n  * Disable HTTP timeout for boot and restore operations via the shell\n  * HTTP layer ignores ErrNoWALToSnapshot when snapshotting\n  * Close Snapshot Streamer ASAP when restoring to local node\n","status":"published","published":"2026-11-03T18:20:11Z","modified":"2026-11-04T14:15:08.559516018Z","updated_at":"2026-11-04T14:31:33.296313Z"},{"id":"SUSE-SU-2026:23506-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.21.1:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-08T14:29:35Z","modified":"2026-09-14T18:23:17.003123411Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23546-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n","status":"published","published":"2026-09-09T12:04:21Z","modified":"2026-09-29T18:23:08.335405944Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23548-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\nThis update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260908.00\n * Migrate presubmits from deb11 to deb12 (#1050)\n * Bump the go_modules group across 1 directory with 3 updates (#1047)\n * Introduce E2E v2 framework and inventory tests (#1039)\n * Remove test case for asserting JSON marshal error from task_state.go (#1045)\n * security: pin GitHub actions to commit SHAs in CodeQL workflow (#1042)\n * Add Configuration for SCALIBR (#1034)\n * add CheckState and Cleanup tests (#1008)\n * Improve unit tests for osinfo/osinfo_linux.go (#1020)\n * Bump github.com/go-git/go-git/v5 (#1036)\n * Bump cloud.google.com/go/auth from 0.18.0 to 0.22.0 (#1032)\n * Bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#1028)\n * authenticate cloud build to use docker registry (#1030)\n * Migrate e2e build to internal image (#1024)\n * Upgrade google.golang.org/grpc to new version. (#1023)\n * Improve unit tests for ospatch/yum_update.go (#1012)\n * Improve unit tests for ospatch/updates.go (#1011)\n * Add unit tests for config/package_resource.go PART 2 (#1005)\n * Add unit tests for config/package_resource.go PART 1 (#1003)\n * Add unit tests for policies/local.go (#1015)\n * Add unit tests for repository_resource.go (#1002)\n * Add unit tests for installrecipe.go part 2 (#993)\n * Add unit tests for scalibr.go (#1019)\n * Add unit tests for installrecipe.go part 1 (#992)\n * Add test cases for policies/recipes/recipedb.go (#989)\n * Bump golang.org/x/crypto (#1021)\n * Add unit tests for policies/recipes/steps.go PART 3 (#976)\n * Add unit tests for policies/recipes/steps.go PART 2 (#975)\n * Bump golang.org/x/net (#1017)\n * upgrade x/net package. (#1018)\n * Add test cases for config/file_resource.go (#988)\n * Add unit tests for policies/recipes/artifacts.go (#985)\n * Add unit tests for policies/recipes/steps.go PART 1 (#974)\n * Add tests \u0026 bugfix for packages/trace.go (#939)\n * Add unit tests for agentendpoint/agentendpoint_beta.go (#983)\n * Replace yum install with yum update (#1009)\n * Bump github.com/containerd/containerd (#1013)\n * Add unit tests for policies/apt.go PART 2 (#957)\n * Add test cases for agentendpoint/task_state.go (#984)\n * Remove deprecated rhel-sap images and add new ones (#1007)\n * Add test cases for clog/clog.go (#986)\n * Use explicit upstream GitHub homepage in URL field\n","status":"published","published":"2026-09-10T08:33:00Z","modified":"2026-09-29T18:23:08.343513232Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23688-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.21.1:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276644).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-08T14:29:35Z","modified":"2026-09-29T18:23:12.089974044Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23708-1","title":"Security update for google-cloud-sap-agent","description":"This update for google-cloud-sap-agent fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279304).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278987).\n\nNon security issue fixed:\n\n- re-enable stripping and debuginfo (bsc#1210938).\n","status":"published","published":"2026-09-14T08:49:02Z","modified":"2026-09-28T18:23:09.538679382Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23729-1","title":"Security update for google-cloud-sap-agent","description":"This update for google-cloud-sap-agent fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279304).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278987).\n\nNon security issue fixed:\n\n- re-enable stripping and debuginfo (bsc#1210938).\n","status":"published","published":"2026-09-14T08:49:02Z","modified":"2026-09-28T18:23:09.537118843Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23730-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1278270).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278273).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1278688).\n","status":"published","published":"2026-09-09T11:53:40Z","modified":"2026-09-29T18:23:13.495337966Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23736-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-14T09:33:48Z","modified":"2026-09-27T18:23:09.684187591Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23739-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260908.00\n","status":"published","published":"2026-09-15T06:54:33Z","modified":"2026-09-27T18:23:09.724146769Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23831-1","title":"Security update for google-guest-agent","description":"This update for google-guest-agent fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278597).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279297).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278967).\n\nChanges for google-guest-agent:\n\n- Update to version 20260903.01\n * Update dependencies to latest (#636)\n * fix octal digit comparison in morePermissive (#631)\n * Remove KillMode from google-guest-agent-manager (#629)\n * Fix SUSE Linux Micro 6+ (#628)\n + Fix oslogin for Micro 6+\n * Exclude irrelevant tests on FreeBSD (#625)\n * Replace abandoned serial dependency (#624)\n * Add build rules for MWLID extension\n * Support basic account management on FreeBSD (#619)\n * fix dependency between sshd and google-guest-agent-manager.service (#621)\n * Update go.mod dependencies (#622)\n * Fallback to shebang execution when running scripts (#618)\n * Update go dependencies (#620)\n * Make guest-agent buildable on FreeBSD (#617)\n","status":"published","published":"2026-09-14T09:47:52Z","modified":"2026-09-27T18:23:14.42755251Z","updated_at":"2026-11-02T15:54:03.991985Z"}]},"sources_more":{"osv":20}}