Search
Find a vulnerability
Search criteria
Related vulnerabilities
GHSA-2V4P-QF9Q-27WJ
Vulnerability from github – Published: 2026-09-08 21:21 – Updated: 2026-09-08 21:21
VLAI
Summary
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
Details
A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).
Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.
This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic. - Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash. - mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.
Impact
An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.
Patches
The issue has been addressed in master (and backported to 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "google.golang.org/grpc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.82.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "google.golang.org/grpc"
},
"ranges": [
{
"events": [
{
"introduced": "1.83.0"
},
{
"fixed": "1.83.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "google.golang.org/grpc"
},
"ranges": [
{
"events": [
{
"introduced": "1.84.0-dev"
},
{
"fixed": "1.85.0-dev.0.20260825072537-93e31b48545e"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-84445"
],
"database_specific": {
"cwe_ids": [
"CWE-129",
"CWE-248"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T21:21:43Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).\n\nServers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request\u2019s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.\n\nThis panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.\n- Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.\n- mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.\n\n### Impact\nAn attacker can cause a complete outage of the gRPC server by sending a request missing both `:authority` and `Host` headers, provided they can successfully establish a transport connection.\n\n### Patches\nThe issue has been addressed in `master` (and backported to `1.83.2` and `1.82.2`). The fix updates the HTTP/2 transport layer to reject requests missing both `:authority` and `Host` headers early, maintaining consistency with and other gRPC language implementations.",
"id": "GHSA-2v4p-qf9q-27wj",
"modified": "2026-09-08T21:21:43Z",
"published": "2026-09-08T21:21:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/issues/9354"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/pull/9365"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/pull/9366"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/pull/9367"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
},
{
"type": "PACKAGE",
"url": "https://github.com/grpc/grpc-go"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers"
}
OPENSUSE-SU-2026:11695-1
Vulnerability from csaf_opensuse - Published: 2026-09-07 00:00 - Updated: 2026-09-07 00:00Summary
cadvisor-0.60.5-3.1 on GA media
Severity
Moderate
Notes
Title of the patch: cadvisor-0.60.5-3.1 on GA media
Description of the patch: These are all security issues fixed in the cadvisor-0.60.5-3.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11695
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.1 (Critical)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
11 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "cadvisor-0.60.5-3.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the cadvisor-0.60.5-3.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11695",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11695-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84303 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84303/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84304 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84304/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84445 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84445/"
}
],
"title": "cadvisor-0.60.5-3.1 on GA media",
"tracking": {
"current_release_date": "2026-09-07T00:00:00Z",
"generator": {
"date": "2026-09-07T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11695-1",
"initial_release_date": "2026-09-07T00:00:00Z",
"revision_history": [
{
"date": "2026-09-07T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cadvisor-0.60.5-3.1.aarch64",
"product": {
"name": "cadvisor-0.60.5-3.1.aarch64",
"product_id": "cadvisor-0.60.5-3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cadvisor-0.60.5-3.1.ppc64le",
"product": {
"name": "cadvisor-0.60.5-3.1.ppc64le",
"product_id": "cadvisor-0.60.5-3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cadvisor-0.60.5-3.1.s390x",
"product": {
"name": "cadvisor-0.60.5-3.1.s390x",
"product_id": "cadvisor-0.60.5-3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cadvisor-0.60.5-3.1.x86_64",
"product": {
"name": "cadvisor-0.60.5-3.1.x86_64",
"product_id": "cadvisor-0.60.5-3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cadvisor-0.60.5-3.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64"
},
"product_reference": "cadvisor-0.60.5-3.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cadvisor-0.60.5-3.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le"
},
"product_reference": "cadvisor-0.60.5-3.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cadvisor-0.60.5-3.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x"
},
"product_reference": "cadvisor-0.60.5-3.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cadvisor-0.60.5-3.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
},
"product_reference": "cadvisor-0.60.5-3.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-84303",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84303"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84303",
"url": "https://www.suse.com/security/cve/CVE-2026-84303"
},
{
"category": "external",
"summary": "SUSE Bug 1278268 for CVE-2026-84303",
"url": "https://bugzilla.suse.com/1278268"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-84303"
},
{
"cve": "CVE-2026-84304",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84304"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84304",
"url": "https://www.suse.com/security/cve/CVE-2026-84304"
},
{
"category": "external",
"summary": "SUSE Bug 1278271 for CVE-2026-84304",
"url": "https://bugzilla.suse.com/1278271"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84304"
},
{
"cve": "CVE-2026-84445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84445"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84445",
"url": "https://www.suse.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "SUSE Bug 1278687 for CVE-2026-84445",
"url": "https://bugzilla.suse.com/1278687"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.aarch64",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.ppc64le",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.s390x",
"openSUSE Tumbleweed:cadvisor-0.60.5-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84445"
}
]
}
OPENSUSE-SU-2026:11697-1
Vulnerability from csaf_opensuse - Published: 2026-09-07 00:00 - Updated: 2026-09-07 00:00Summary
distribution-registry-3.1.1-6.1 on GA media
Severity
Moderate
Notes
Title of the patch: distribution-registry-3.1.1-6.1 on GA media
Description of the patch: These are all security issues fixed in the distribution-registry-3.1.1-6.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11697
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
9.1 (Critical)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
14 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "distribution-registry-3.1.1-6.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the distribution-registry-3.1.1-6.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11697",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11697-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-37236 page",
"url": "https://www.suse.com/security/cve/CVE-2026-37236/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84303 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84303/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84304 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84304/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84445 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84445/"
}
],
"title": "distribution-registry-3.1.1-6.1 on GA media",
"tracking": {
"current_release_date": "2026-09-07T00:00:00Z",
"generator": {
"date": "2026-09-07T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11697-1",
"initial_release_date": "2026-09-07T00:00:00Z",
"revision_history": [
{
"date": "2026-09-07T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-6.1.aarch64",
"product": {
"name": "distribution-registry-3.1.1-6.1.aarch64",
"product_id": "distribution-registry-3.1.1-6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-6.1.ppc64le",
"product": {
"name": "distribution-registry-3.1.1-6.1.ppc64le",
"product_id": "distribution-registry-3.1.1-6.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-6.1.s390x",
"product": {
"name": "distribution-registry-3.1.1-6.1.s390x",
"product_id": "distribution-registry-3.1.1-6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-6.1.x86_64",
"product": {
"name": "distribution-registry-3.1.1-6.1.x86_64",
"product_id": "distribution-registry-3.1.1-6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-6.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64"
},
"product_reference": "distribution-registry-3.1.1-6.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-6.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le"
},
"product_reference": "distribution-registry-3.1.1-6.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-6.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x"
},
"product_reference": "distribution-registry-3.1.1-6.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-6.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
},
"product_reference": "distribution-registry-3.1.1-6.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-37236",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-37236"
}
],
"notes": [
{
"category": "general",
"text": "grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-37236",
"url": "https://www.suse.com/security/cve/CVE-2026-37236"
},
{
"category": "external",
"summary": "SUSE Bug 1277941 for CVE-2026-37236",
"url": "https://bugzilla.suse.com/1277941"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-37236"
},
{
"cve": "CVE-2026-84303",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84303"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84303",
"url": "https://www.suse.com/security/cve/CVE-2026-84303"
},
{
"category": "external",
"summary": "SUSE Bug 1278268 for CVE-2026-84303",
"url": "https://bugzilla.suse.com/1278268"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-84303"
},
{
"cve": "CVE-2026-84304",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84304"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84304",
"url": "https://www.suse.com/security/cve/CVE-2026-84304"
},
{
"category": "external",
"summary": "SUSE Bug 1278271 for CVE-2026-84304",
"url": "https://bugzilla.suse.com/1278271"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84304"
},
{
"cve": "CVE-2026-84445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84445"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84445",
"url": "https://www.suse.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "SUSE Bug 1278687 for CVE-2026-84445",
"url": "https://bugzilla.suse.com/1278687"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.aarch64",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.ppc64le",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.s390x",
"openSUSE Tumbleweed:distribution-registry-3.1.1-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84445"
}
]
}
OPENSUSE-SU-2026:11699-1
Vulnerability from csaf_opensuse - Published: 2026-09-07 00:00 - Updated: 2026-09-07 00:00Summary
google-guest-agent-20260903.00-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: google-guest-agent-20260903.00-1.1 on GA media
Description of the patch: These are all security issues fixed in the google-guest-agent-20260903.00-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11699
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "google-guest-agent-20260903.00-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the google-guest-agent-20260903.00-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11699",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11699-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56854 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56854/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84445 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84445/"
}
],
"title": "google-guest-agent-20260903.00-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-07T00:00:00Z",
"generator": {
"date": "2026-09-07T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11699-1",
"initial_release_date": "2026-09-07T00:00:00Z",
"revision_history": [
{
"date": "2026-09-07T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260903.00-1.1.aarch64",
"product": {
"name": "google-guest-agent-20260903.00-1.1.aarch64",
"product_id": "google-guest-agent-20260903.00-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260903.00-1.1.ppc64le",
"product": {
"name": "google-guest-agent-20260903.00-1.1.ppc64le",
"product_id": "google-guest-agent-20260903.00-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260903.00-1.1.s390x",
"product": {
"name": "google-guest-agent-20260903.00-1.1.s390x",
"product_id": "google-guest-agent-20260903.00-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260903.00-1.1.x86_64",
"product": {
"name": "google-guest-agent-20260903.00-1.1.x86_64",
"product_id": "google-guest-agent-20260903.00-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260903.00-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64"
},
"product_reference": "google-guest-agent-20260903.00-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260903.00-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le"
},
"product_reference": "google-guest-agent-20260903.00-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260903.00-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x"
},
"product_reference": "google-guest-agent-20260903.00-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260903.00-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
},
"product_reference": "google-guest-agent-20260903.00-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56854",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56854"
}
],
"notes": [
{
"category": "general",
"text": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56854",
"url": "https://www.suse.com/security/cve/CVE-2026-56854"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-56854",
"url": "https://bugzilla.suse.com/1278446"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56854"
},
{
"cve": "CVE-2026-84445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84445"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84445",
"url": "https://www.suse.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "SUSE Bug 1278687 for CVE-2026-84445",
"url": "https://bugzilla.suse.com/1278687"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.aarch64",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.ppc64le",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.s390x",
"openSUSE Tumbleweed:google-guest-agent-20260903.00-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84445"
}
]
}
OPENSUSE-SU-2026:11700-1
Vulnerability from csaf_opensuse - Published: 2026-09-07 00:00 - Updated: 2026-09-07 00:00Summary
hauler-2.1.0-3.1 on GA media
Severity
Moderate
Notes
Title of the patch: hauler-2.1.0-3.1 on GA media
Description of the patch: These are all security issues fixed in the hauler-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11700
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.1 (Critical)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
11 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "hauler-2.1.0-3.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the hauler-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11700",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11700-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84303 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84303/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84304 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84304/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84445 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84445/"
}
],
"title": "hauler-2.1.0-3.1 on GA media",
"tracking": {
"current_release_date": "2026-09-07T00:00:00Z",
"generator": {
"date": "2026-09-07T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11700-1",
"initial_release_date": "2026-09-07T00:00:00Z",
"revision_history": [
{
"date": "2026-09-07T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "hauler-2.1.0-3.1.aarch64",
"product": {
"name": "hauler-2.1.0-3.1.aarch64",
"product_id": "hauler-2.1.0-3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "hauler-2.1.0-3.1.ppc64le",
"product": {
"name": "hauler-2.1.0-3.1.ppc64le",
"product_id": "hauler-2.1.0-3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "hauler-2.1.0-3.1.s390x",
"product": {
"name": "hauler-2.1.0-3.1.s390x",
"product_id": "hauler-2.1.0-3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "hauler-2.1.0-3.1.x86_64",
"product": {
"name": "hauler-2.1.0-3.1.x86_64",
"product_id": "hauler-2.1.0-3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "hauler-2.1.0-3.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64"
},
"product_reference": "hauler-2.1.0-3.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hauler-2.1.0-3.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le"
},
"product_reference": "hauler-2.1.0-3.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hauler-2.1.0-3.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x"
},
"product_reference": "hauler-2.1.0-3.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hauler-2.1.0-3.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
},
"product_reference": "hauler-2.1.0-3.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-84303",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84303"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84303",
"url": "https://www.suse.com/security/cve/CVE-2026-84303"
},
{
"category": "external",
"summary": "SUSE Bug 1278268 for CVE-2026-84303",
"url": "https://bugzilla.suse.com/1278268"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-84303"
},
{
"cve": "CVE-2026-84304",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84304"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84304",
"url": "https://www.suse.com/security/cve/CVE-2026-84304"
},
{
"category": "external",
"summary": "SUSE Bug 1278271 for CVE-2026-84304",
"url": "https://bugzilla.suse.com/1278271"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84304"
},
{
"cve": "CVE-2026-84445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84445"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84445",
"url": "https://www.suse.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "SUSE Bug 1278687 for CVE-2026-84445",
"url": "https://bugzilla.suse.com/1278687"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:hauler-2.1.0-3.1.aarch64",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.ppc64le",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.s390x",
"openSUSE Tumbleweed:hauler-2.1.0-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84445"
}
]
}
OPENSUSE-SU-2026:11713-1
Vulnerability from csaf_opensuse - Published: 2026-09-07 00:00 - Updated: 2026-09-07 00:00Summary
trivy-0.74.0-4.1 on GA media
Severity
Moderate
Notes
Title of the patch: trivy-0.74.0-4.1 on GA media
Description of the patch: These are all security issues fixed in the trivy-0.74.0-4.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11713
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.1 (Critical)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
critical
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
11 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "trivy-0.74.0-4.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the trivy-0.74.0-4.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11713",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11713-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84303 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84303/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84304 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84304/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-84445 page",
"url": "https://www.suse.com/security/cve/CVE-2026-84445/"
}
],
"title": "trivy-0.74.0-4.1 on GA media",
"tracking": {
"current_release_date": "2026-09-07T00:00:00Z",
"generator": {
"date": "2026-09-07T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11713-1",
"initial_release_date": "2026-09-07T00:00:00Z",
"revision_history": [
{
"date": "2026-09-07T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.74.0-4.1.aarch64",
"product": {
"name": "trivy-0.74.0-4.1.aarch64",
"product_id": "trivy-0.74.0-4.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.74.0-4.1.ppc64le",
"product": {
"name": "trivy-0.74.0-4.1.ppc64le",
"product_id": "trivy-0.74.0-4.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.74.0-4.1.s390x",
"product": {
"name": "trivy-0.74.0-4.1.s390x",
"product_id": "trivy-0.74.0-4.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.74.0-4.1.x86_64",
"product": {
"name": "trivy-0.74.0-4.1.x86_64",
"product_id": "trivy-0.74.0-4.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.74.0-4.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64"
},
"product_reference": "trivy-0.74.0-4.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.74.0-4.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le"
},
"product_reference": "trivy-0.74.0-4.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.74.0-4.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x"
},
"product_reference": "trivy-0.74.0-4.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.74.0-4.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
},
"product_reference": "trivy-0.74.0-4.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-84303",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84303"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84303",
"url": "https://www.suse.com/security/cve/CVE-2026-84303"
},
{
"category": "external",
"summary": "SUSE Bug 1278268 for CVE-2026-84303",
"url": "https://bugzilla.suse.com/1278268"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-84303"
},
{
"cve": "CVE-2026-84304",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84304"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84304",
"url": "https://www.suse.com/security/cve/CVE-2026-84304"
},
{
"category": "external",
"summary": "SUSE Bug 1278271 for CVE-2026-84304",
"url": "https://bugzilla.suse.com/1278271"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84304"
},
{
"cve": "CVE-2026-84445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-84445"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-84445",
"url": "https://www.suse.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "SUSE Bug 1278687 for CVE-2026-84445",
"url": "https://bugzilla.suse.com/1278687"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:trivy-0.74.0-4.1.aarch64",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.s390x",
"openSUSE Tumbleweed:trivy-0.74.0-4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-84445"
}
]
}