{"id":"CVE-2026-89090","aliases":["EUVD-2026-76157","GHSA-xmrv-pmrh-hhx2","GO-2026-5764","ROOT-APP-GOBINARY-GHSA-xmrv-pmrh-hhx2","SUSE-SU-2026:24148-1","SUSE-SU-2026:24265-1","SUSE-SU-2026:4408-1","openSUSE-SU-2026:11803-1","openSUSE-SU-2026:11821-1","openSUSE-SU-2026:12107-1","openSUSE-SU-2026:12186-1","openSUSE-SU-2026:12208-1","openSUSE-SU-2026:21925-1","openSUSE-SU-2026:22032-1","openSUSE-SU-2026:22145-1","openSUSE-SU-2026:22224-1"],"status":"published","title":"Denial of service in the event stream header decoder in AWS SDK for Go v2","description":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00305,"percentile":0.23479,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-248"],"published":"2026-04-08T00:18:56Z","modified":"2026-11-04T14:27:28Z","fixes":[{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","fixed_in":["1.7.8"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","fixed_in":["1.15.2"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","fixed_in":["1.51.8"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","fixed_in":["1.50.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","fixed_in":["1.65.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","fixed_in":["1.52.19"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/kinesis","fixed_in":["1.43.5"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lambda","fixed_in":["1.88.5"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","fixed_in":["1.35.15"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/s3","fixed_in":["1.97.3"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","fixed_in":["1.39.6"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","fixed_in":["1.34.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","fixed_in":["v1.63.0-root.io.1","v1.63.0-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/service/kinesis","fixed_in":["v1.42.9-root.io.1","v1.42.9-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","fixed_in":["v1.7.4-root.io.1","v1.7.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","fixed_in":["v1.7.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","fixed_in":["v1.63.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/service/kinesis","fixed_in":["v1.42.9-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/service/s3","fixed_in":["v1.71.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/service/s3","fixed_in":["v1.71.0-aikido.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"keybase-client","fixed_in":["6.6.3-5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"keybase-client","fixed_in":["6.6.3-bp160.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.19"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/kinesis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lambda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.88.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.15"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/s3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.97.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.51.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.50.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.65.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.52.19"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/kinesis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lambda","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.88.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.15"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/s3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.97.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.39.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentcore","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.51.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/bedrockruntime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.50.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.65.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/iotsitewise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.52.19"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/kinesis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lambda","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.88.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/lexruntimev2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.15"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/s3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.97.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/sagemakerruntime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.39.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/aws/aws-sdk-go-v2/service/transcribestreaming","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.34.5"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.63.0-root.io.1"},{"fixed":"v1.63.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/service/kinesis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.42.9-root.io.1"},{"fixed":"v1.42.9-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.7.4-root.io.1"},{"fixed":"v1.7.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.7.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.63.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/service/kinesis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.42.9-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/aws/aws-sdk-go-v2/service/s3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.71.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/aws/aws-sdk-go-v2/service/s3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.71.0-aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.108.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.108.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150700.15.29.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"keybase-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.108.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"amazon-cloudwatch-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.300073.0-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"keybase-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp160.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-160000.1.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"amazon-ecs-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.108.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.6-bp160.1.1"}]}],"bundled":6}],"products":[{"vendor":"aws","product":"aws sdk for go v2"}],"references":[{"url":"https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","tags":["third-party-advisory","advisory","web"]},{"url":"https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23","tags":["patch","fix","web"]},{"url":"https://aws.amazon.com/security/security-bulletins/2026-110-aws/","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/advisories/GHSA-xmrv-pmrh-hhx2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89090.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89090","tags":["advisory"]},{"url":"https://github.com/aws/aws-sdk-go-v2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267482","tags":["report"]},{"url":"https://bugzilla.suse.com/1267483","tags":["report"]},{"url":"https://bugzilla.suse.com/1267484","tags":["report"]},{"url":"https://bugzilla.suse.com/1267486","tags":["report"]},{"url":"https://bugzilla.suse.com/1267487","tags":["report"]},{"url":"https://bugzilla.suse.com/1268982","tags":["report"]},{"url":"https://bugzilla.suse.com/1269861","tags":["report"]},{"url":"https://bugzilla.suse.com/1272028","tags":["report"]},{"url":"https://bugzilla.suse.com/1272418","tags":["report"]},{"url":"https://bugzilla.suse.com/1276742","tags":["report"]},{"url":"https://bugzilla.suse.com/1276982","tags":["report"]},{"url":"https://bugzilla.suse.com/1276992","tags":["report"]},{"url":"https://bugzilla.suse.com/1277429","tags":["report"]},{"url":"https://bugzilla.suse.com/1277996","tags":["report"]},{"url":"https://bugzilla.suse.com/1278671","tags":["report"]},{"url":"https://bugzilla.suse.com/1278693","tags":["report"]},{"url":"https://bugzilla.suse.com/1280671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89090","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624265-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279042","tags":["report"]},{"url":"https://bugzilla.suse.com/1280679","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264408-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://bugzilla.suse.com/1280628","tags":["report"]},{"url":"https://bugzilla.suse.com/1266544","tags":["report"]},{"url":"https://bugzilla.suse.com/1278793","tags":["report"]},{"url":"https://bugzilla.suse.com/1279102","tags":["report"]},{"url":"https://bugzilla.suse.com/1279253","tags":["report"]},{"url":"https://bugzilla.suse.com/1280657","tags":["report"]},{"url":"https://bugzilla.suse.com/1283555","tags":["report"]},{"url":"https://bugzilla.suse.com/1286934","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-89090","title":"Denial of service in the event stream header decoder in AWS SDK for Go v2","description":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.","status":"published","published":"2026-09-11T17:03:33.351Z","modified":"2026-09-24T19:29:25.97Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-76157","description":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.","status":"published","published":"2026-09-11T17:03:33Z","modified":"2026-09-24T19:29:25Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:56.296478Z"}],"ghsa":[{"id":"GHSA-xmrv-pmrh-hhx2","title":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","description":"**CVSSv3.1 Rating**: [Medium]\n**CVSSv3.1 Score**: [5.9]\n**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]\n\n## Summary and Impact\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: \u003c [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)\n\n## Patches\nThis issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n## Workarounds\nNot Applicable\n\n## References\nIf you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","status":"published","published":"2026-04-08T00:18:56Z","modified":"2026-04-08T00:18:59Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:51.193071Z"}],"nvd":[{"id":"CVE-2026-89090","description":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.","status":"published","published":"2026-09-11T18:17:00.097Z","modified":"2026-09-11T20:19:22.68Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"CVE-2026-89090","title":"Denial of service in the event stream header decoder in AWS SDK for Go v2","description":"An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.","status":"published","published":"2026-09-11T17:03:33.351Z","modified":"2026-11-04T14:27:28.32064348Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-04T15:05:08.862156Z"},{"id":"GHSA-xmrv-pmrh-hhx2","title":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","description":"**CVSSv3.1 Rating**: [Medium]\n**CVSSv3.1 Score**: [5.9]\n**CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]\n\n## Summary and Impact\nAn issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.\n\nImpacted versions: \u003c [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)\n\n## Patches\nThis issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n## Workarounds\nNot Applicable\n\n## References\nIf you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","status":"published","published":"2026-04-08T00:18:56Z","modified":"2026-09-12T04:10:37.759930105Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"ROOT-APP-GOBINARY-GHSA-xmrv-pmrh-hhx2","title":"GHSA-xmrv-pmrh-hhx2 in rootio-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs - Patched by Root","description":"Root has patched GHSA-xmrv-pmrh-hhx2 in the rootio-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-07-21T07:25:19Z","modified":"2026-07-21T12:15:12.495124371Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"GO-2026-5764","title":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","description":"DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","status":"published","published":"2026-07-07T16:52:19Z","modified":"2026-09-12T04:10:37.759930105Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:11803-1","title":"alloy-1.19.2-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-09-18T18:23:08.624887714Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11821-1","title":"kbfs-6.6.3-5.1 on GA media","description":"These are all security issues fixed in the kbfs-6.6.3-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-19T00:00:00Z","modified":"2026-09-20T16:15:03.263768027Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12107-1","title":"amazon-ecs-init-1.108.0-1.1 on GA media","description":"These are all security issues fixed in the amazon-ecs-init-1.108.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-13T10:30:04.818557499Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12186-1","title":"rqlite-10.6.1-1.1 on GA media","description":"These are all security issues fixed in the rqlite-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:05.162125074Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12208-1","title":"amazon-cloudwatch-agent-1.300073.0-3.1 on GA media","description":"These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:12.276879912Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21925-1","title":"Security update for keybase-client","description":"This update for keybase-client fixes the following issues:\n\nChanges in keybase-client:\n\n- CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n","status":"published","published":"2026-09-21T14:35:49Z","modified":"2026-09-25T18:23:13.340835302Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22032-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:15:27Z","modified":"2026-10-09T17:23:14.415693669Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22145-1","title":"Security update for amazon-ecs-init","description":"This update for amazon-ecs-init fixes the following issues:\n\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1279042).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280679).\n\nChanges for amazon-ecs-init:\n\n- Update to version 1.108.0\n * Enhancement - Add ECS-Init install pointer for non-Amazon Linux\n AMIs to README (#5161)\n * Enhancement - Remove direct docker run instructions from README (#5160)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1\n to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)\n * Feature - Enable IMDS IAM roles config resolution (#5154)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.33\n to 1.7.36 in /agent (#5155)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.35\n to 1.7.36 in /ecs-init (#5156)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from\n 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)\n * Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2\n in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153)\n (bsc#1279042, CVE-2026-84445)\n * Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/\n otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)\n * Enhancement - IMDS credential scanner/refresher updates (#5145)\n","status":"published","published":"2026-10-20T15:10:57Z","modified":"2026-10-23T17:23:11.75305154Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22224-1","title":"Security update for rqlite","description":"This update for rqlite fixes the following issues:\n\nChanges in rqlite:\n\n- Update to version 10.6.6:\n  * Keep the local auto-backup file if the metadata rename fails\n  * Reject local auto-backup filenames reserved for internal use\n  * POST /demote and POST /promote return a JSON error body, and\n    404 when the target node is not in the cluster.\n  * DELETE /remove returns a JSON error body.\n- Includes changes from  version 10.6.5:\n  * Guard the inter-node backup stream handler directly against a\n    missing backup request\n  * POST /leader returns a JSON error body, and 404 when the target\n    node is not in the cluster\n\n- Update to version 10.6.4:\n  * BACKUP_STREAM authorization failures can disclose the database\n    and crash rqlited (boo#1286934)\n  * GET /leader returns a JSON error body when there is no leader\n  * Close the connection after rejecting an unauthorized inter-node\n    backup stream request, instead of streaming the database anyway\n  * Decide inter-node command authorization once, before dispatch,\n    and close the connection after rejecting any unauthorized\n    command\n\n- Update to version 10.6.3:\n  * Node probes honor request context and commit exactly one\n    result\n  * Make DB connections a first-class object\n  * Prevent ATTACH on the query database connection\n\n- Update to version 10.6.2:\n  * Check for trailing junk in request bodies\n  * Console schema view handles table names that collide with\n    JavaScript object properties\n  * Set CommitTimestamps in CDC Events Group\n  * Upgrade dependencies\n\n- Update to version 10.6.1:\n  * Use constant-time comparison when comparing passwords\n  * Conditionally rewrite SQL during queued writes and fix\n    rewriting of CURRENT_TIMESTAMP and related tokens\n  * More robust Leader stepdown node ID detection, reap checks,\n    and SQL analyze start-time recording\n  * CDC fixes: encode non-finite floats, always release flush\n    waiters, and make the HTTP sink follow redirects\n  * Converted _service from mode=disabled to mode=manual (legacy\n    leftover; services are run by hand via osc service manualrun)\n  * Package is not affected by CVE-2026-84445 (boo#1278793),\n    CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):\n    vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes\n  * Package is not affected by CVE-2026-89090 (boo#1280657):\n    vendored eventstream is v1.7.20, above the v1.7.8 fix\n  * Package is not affected by CVE-2026-63209 (boo#1283555):\n    vendored klauspost/compress is v1.20.1, above the v1.18.7\n    fix\n  * Package is not affected by CVE-2026-39821 (boo#1266544):\n    vendored golang.org/x/net is v0.59.0, above the v0.55.0\n    fix\n\n- Update to version 10.6.0:\n  * API addition: error_v2 may contain numeric SQLite error codes.\n  * addresses a security issue related to Authentication files. A\n    user with no explicit permissions could be grant elevated\n    permissions. Correctly configured users do not suffer from this\n    issue.\n  * multiple implementation changes and bug fixes\n  * Display interactive cluster topology on web console.\n  * Support configurable queued-writes retries\n  * release addresses a gap in the role-based access permissions\n    related to change-data-capture (CDC) handling\n\n- Update to version 10.3.6:\n  * Add query logging to database layer\n  * Snapshot IDs now contain (optional) generation\n  * Bump generation ID if snapshot IDs collide\n  * Snapshots can be filtered by term and index\n  * Add support for File Renaming and Removing with retries\n  * Replace standard library with fsutil\n  * Keep snapshot ordering correct regardless of clock\n  * Remove snapshot name generation ID\n\n- Update to version 10.3.5:\n  * Reject alternate form of unsupported PRAGMA commands\n  * Handle negative trailing logs\n  * Sync access to last backup time at http layer\n  * Set the \"Served by\" header before first backup byte\n  * Set DB load response time for all formats\n  * Fix HTTP logic error for queued statements\n  * Minor web console fixes\n- includes changes from 10.0.4:\n  * Do not emit rolled-back events over CDC\n- includes changes from 10.0.3:\n  * Refactor busy timeout methods\n  * Fix edge-case bugs detected by GPT-6 Astra\n  * Switch to quay.io/minio/minio:latest for testing purposes\n  * Fix removing a node with different ID, but same Raft address\n  * Use correct Foreign Key setting when recovering node\n  * Only dump the indexes and triggers of the selected tables\n  * Detect DB changes during Request(RETURNING)\n  * Snapshot Open() first checks for failed reap\n  * Sync snapshot plan directory\n  * Propagate WAL stat errors\n  * Clean up cancelled snapshots\n  * Reject incomplete snapshot headers\n  * Validate restore database header\n  * Only reap a sole fullsnapshot if it has zero WALs\n  * Keep database dumps consistent during writes to the database\n  * Roll back DB Requests on statement-prepare errors\n- includes changes from 10.0.2:\n  * Upgrade SQLite driver\n  * Unit test reaping an installed Snapshot and streamed Snapshot combo\n  * Use distinct Snapshot Namer type\n  * Replace breaking-pragma regexes with ASCII prefix scanning\n  * Consolidate pragma and txStatus reads onto a single connection per pool\n  * Fix some magic strings in db package\n\n- Update to version 10.3.1:\n  * Consolidate SQLite driver construction\n  * Plumb Term and Index through during Snapshot Restore\n  * Hard exit if FSM Restore fails post database-swap\n\n- Update to version 10.3.0:\n  * Console app supports quickly querying for first 100 rows of a\n    table\n  * Rename read-only nodes to read replicas. Command-line flags\n    unchanged\n  * Bundles dependencies updated\n  * Add infra for pushing OTLP metrics to an OpenTelemetry\n    Collector\n  * Add query logging at database level\n  * Add CopyDir functionality to file utils.\n  * Add ability to clone Snapshots, primarily for testing purposes\n  * Store Index and Term in Fingerprint file and check during\n    start-up\n\n- Update to version 10.2.7:\n  * Remove explicit database-level read-only check from the pure\n    Query path\n  * Miscellaneous Store-level fixes related to resource management\n    and shutdown sequence\n  * Don't run CRC checks twice on Snapshot when fast-restart is\n    explicitly disabled\n  * Fixes to the http package including SQL rewriting control.\n  * Address potential dropped CDC event on restart\n  * Various minor fixes\n - includes changes from 10.2.6:\n  * Handle a fully-executed Reap plan, but Plan file itself not\n    removed\n  * Close Snapshot streamer on error.\n- includes changes from 10.2.5:\n  * Perform a Quick Integrity check after reaping snapshots, not\n    Full\n\n- Update to version 10.2.4:\n  * Fix some non-AWS S3-compatible stores\n- includes changes from 10.2.3\n  * Check snapshot store integrity before first actual use\n  * Disable HTTP timeout for boot and restore operations via the shell\n  * HTTP layer ignores ErrNoWALToSnapshot when snapshotting\n  * Close Snapshot Streamer ASAP when restoring to local node\n","status":"published","published":"2026-11-03T18:20:11Z","modified":"2026-11-04T14:15:08.559516018Z","updated_at":"2026-11-04T14:31:33.296313Z"},{"id":"SUSE-SU-2026:24148-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n","status":"published","published":"2026-10-06T13:07:44Z","modified":"2026-10-16T17:23:10.706600173Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24265-1","title":"Security update for amazon-ecs-init","description":"This update for amazon-ecs-init fixes the following issues:\n\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1279042).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280679).\n\nChanges for amazon-ecs-init:\n\n- Update to version 1.108.0\n * Enhancement - Add ECS-Init install pointer for non-Amazon Linux\n AMIs to README (#5161)\n * Enhancement - Remove direct docker run instructions from README (#5160)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.28.1\n to 1.33.6 in /ecs-agent, /agent, and /ecs-init (#5159)\n * Feature - Enable IMDS IAM roles config resolution (#5154)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.33\n to 1.7.36 in /agent (#5155)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.35\n to 1.7.36 in /ecs-init (#5156)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/ec2 from\n 1.195.0 to 1.334.0 in /ecs-agent and /agent (#5148)\n * Enhancement - Bump google.golang.org/grpc from 1.83.1 to 1.83.2\n in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5153)\n (bsc#1279042, CVE-2026-84445)\n * Enhancement - Bump go.opentelemetry.io/otel/exporters/otlp/\n otlptrace/otlptracehttp from 1.43.0 to 1.45.0 in /agent (#5141)\n * Enhancement - IMDS credential scanner/refresher updates (#5145)\n","status":"published","published":"2026-10-20T15:19:51Z","modified":"2026-10-23T17:23:10.722556953Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4408-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n  (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n  exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n  (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n  out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n  that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n  read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n  parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n  agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n  (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n  modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n  (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n  Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n  containing a crafted header value type byte outside the valid range can cause the host process to terminate\n  (bsc#1280671).\n\nChanges for alloy:\n\n- Update to version 1.19.2.\n- Update to version 1.19.1.\n- Update to version 1.19.0:\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n- Update to version 1.18.1:\n * Add nop receiver to OTel Engine\n","status":"published","published":"2026-10-01T07:07:12Z","modified":"2026-10-01T17:30:06.30494489Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}