CVE-2026-41678

Summary

aes::unwrap_key() has an incorrect bounds assertion on the out buffer size, which can lead to out-of-bounds write.

Details

aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough.

Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function.

Impact

Vulnerable applications using AES keywrap and allowing attacker controlled buffer sizes could have an attacker trigger an out-of-bounds write.

rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function. This vulnerability is fixed in 0.10.78.

rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function. This vulnerability is fixed in 0.10.78.

These are all security issues fixed in the cargo-c-0.10.23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the keylime-ima-policy-0.2.9+49-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.28.2~0-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sccache-0.16.0~0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-maturin-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sdbootutil-1+git20260713.d869cf8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the snpguest-0.10.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the snphost-0.7.0-3.1 package on the GA media of openSUSE Tumbleweed.

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for agama fixes the following issues

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270602).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270678).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270784).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270850).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270526).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270891).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270992).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270542).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270747).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270839).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270492).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270932).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270952).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.4.5.

This update for libkrun fixes the following issues:

• CVE-2025-24898: openssl: use-after-free in ssl::select_next_proto due to improper lifetime handling (bsc#1270429).
• CVE-2026-41676: openssl: short buffer overflow via Deriver:derive and PkeyCtxRef:derive when using OpenSSL 1.1.1 (bsc#1270198).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270582).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270683).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270721).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270831).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270470).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270877).

This update for snpguest fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270947).

This update for snphost fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: OOB write due to incorrectly sized output buffers in CipherCtxRef::cipher_update_inplace when it is used with AES key-wrap-with-padding ciphers (bsc#1270947).

This update for sdbootutil fixes the following issues:

Security issues fixed:

• CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192).
• CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270616).
• CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
• CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742).
• CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863).
• CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471).
• CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922).
• CVE-2026-45784: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995).

Non security issues fixed:

• sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384).
• systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
• Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

Changes for sdbootutil:

• Update to version 1+git20260908.c641fc2:

• Update the shim when required
• Warn when recovery PIN is different from recovery key
• Improves extra boot entries support
• Better report when the default snapshot diverges
• Explain how to do re-enrolling if recovery PIN fails
• Explain why update-prediction fails and how to solve it
• Hide comparison output
• Add bootctl default entry in the prediction

• Update to version 1+git20260903.f91f636:

• Include FIDO2 unlocked devices for ordering (bsc#1234010)
• Test in parallel for speed up
• Add --repair parameter to cleanup
• Fix shellcheck complain
• Report entries with missing files
• Avoid duplicate entries in non-snapper systems
• Add initial tests for sdbootutil
• Report the error if bootctl clean fails

• Update to version 1+git20260901.41540d5:

• No warn if a component is not in the event log
• Add status command
• Select the new sdbootutil if available
• Skip blank lines in measure-pcr-generator.sh
• Do not change crypttab for unrelated entries
• Report the bad PCR when update-prediction fail
• Do not write the recovery PIN in the journal
• Improves non snapshot system support
• Update help message for --measure-pcr
• Report when PCR 7 is dropped because shim update
• Add --strict parameter for --pcr policy
• Report dropped PCRs via a warn
• Adjust the limits for PolicyOR issues
• Avoid update predictions if the service is up
• Keep the exit status of sdbootutil call

• Update to version 1+git20260827.786f9a8:

• Do not accept empty passwords
• jeos-firstboot-enroll: report errors also in the journal
• Restore old crypttab via the exit trap
• Update CLAUDE data
• Detect half created openssl keys
• check_enrolled report when something was written in the LUKS2 header
• Improve a bit the disk-encryption-tool keyslot detection
• Avoid leak of env var secrets
• Wipe the d-e-t key in the enroll service and jeos module
• Remove the correct keyslot left by d-e-t
• Differentiate tpm2 and tpm2+pin for unattended unlock
• Use is_same_device in detect_tracked_device and drop greps
• Refactor check to avoid shellcheck complain
• Parse the entry file in a sigle place
• Validate the entry with the new kernel name
• Refactor enrollment interface and deprecate the old one
• New kernels will have different hash
• Warn If no crypttab entry found
• Extend is_same_device
• jeos-firstboot-enroll: validate the passwords
• sdbootutil-enroll: report when no encryption method is provided
• Write recovery pin after enrollment in…

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

openssl::aes::unwrap_key guarded the size of its output buffer with an inverted assertion, out.len() + 8 <= in_.len(). Instead of rejecting an out buffer too small for the unwrapped key, it rejected buffers larger than needed and accepted buffers that were too small.

When out is shorter than in_.len() - 8 bytes, the underlying AES_unwrap_key call writes past the end of out. This out-of-bounds write is reachable from a safe function; applications that let untrusted input influence the input or output buffer sizes are exposed.

The function was added in 0.10.24. 0.10.78 corrects the assertion, so an output buffer that is too small now causes a panic before anything is written.

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for agama fixes the following issues

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270602).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270678).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270784).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270850).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270526).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270891).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270992).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270620).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270801).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270542).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270747).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270839).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270492).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270932).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270952).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.4.5.

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270620).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270801).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270994).

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for afterburn fixes the following issues

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead to DoS (bsc#1196972).
• CVE-2024-12224: idna: privilege escalation due acceptance Punycode labels that do not produce any non-ASCII when decoded (bsc#1243850).
• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch (bsc#1242665).
• CVE-2025-5791: users: root appended to group listings unless the correct listing has exactly 1024 groups (bsc#1244199).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to…

This update for rust-keylime fixes the following issues

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for libkrun fixes the following issues:

• CVE-2025-24898: openssl: select_next_proto use after free in rust-openssl (bsc#1270429).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270198).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270582).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270683).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270721).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270831).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270470).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270877).

Changes for libkrun:

• Update vendored openssl crate to version 0.10.81.

This update for libkrun fixes the following issues:

• CVE-2025-24898: openssl: use-after-free in ssl::select_next_proto due to improper lifetime handling (bsc#1270429).
• CVE-2026-41676: openssl: short buffer overflow via Deriver:derive and PkeyCtxRef:derive when using OpenSSL 1.1.1 (bsc#1270198).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270582).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270683).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270721).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270831).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270470).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270877).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for snpguest fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270947).

This update for snphost fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: OOB write due to incorrectly sized output buffers in CipherCtxRef::cipher_update_inplace when it is used with AES key-wrap-with-padding ciphers (bsc#1270947).

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for rust-keylime fixes the following issues

• Update to version 0.2.9+49
• Update openssl to 0.10.81
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).