Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-39821 (GCVE-0-2026-39821)
Vulnerability from cvelistv5 – Published: 2026-05-22 15:01 – Updated: 2026-07-10 12:05
VLAI
EPSS
VEX
Title
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Summary
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Severity
9.6 (Critical)
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Assigner
References
47 references
Impacted products
89 products
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/net | golang.org/x/net/idna |
Affected:
0 , < 0.55.0
(semver)
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.22 |
cpe:/a:redhat:openshift:4.22::el8 cpe:/a:redhat:openshift:4.22::el9 |
|
| Red Hat | RHEM 1.0 for RHEL 9 |
cpe:/a:redhat:edge_manager:1.0::el9 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Cluster Observability Operator 1.5.0 |
cpe:/a:redhat:cluster_observability_operator:1.5::el9 |
|
| Red Hat | DevWorkspace Operator 0.42 |
cpe:/a:redhat:devworkspace:0.42::el9 |
|
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.4 |
cpe:/a:redhat:logging:6.4::el9 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 |
cpe:/a:redhat:acm:2.13::el9 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 |
cpe:/a:redhat:advanced_cluster_security:4.10::el8 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.11 |
cpe:/a:redhat:advanced_cluster_security:4.11::el9 |
|
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.9 |
cpe:/a:redhat:advanced_cluster_security:4.9::el8 |
|
| Red Hat | Red Hat Edge Manager 1.0 |
cpe:/a:redhat:edge_manager:1.0::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.4 |
cpe:/a:redhat:enterprise_linux_ai:3.4::el9 |
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat OpenShift Builds 1.7.4 |
cpe:/a:redhat:openshift_builds:1.7::el9 |
|
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 |
cpe:/a:redhat:openshift_devspaces:3.29::el9 |
|
| Red Hat | Red Hat OpenShift GitOps 1.19 |
cpe:/a:redhat:openshift_gitops:1.19::el8 |
|
| Red Hat | Red Hat OpenShift GitOps 1.20 |
cpe:/a:redhat:openshift_gitops:1.20::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 2.6 |
cpe:/a:redhat:service_mesh:2.6::el8 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.1 |
cpe:/a:redhat:service_mesh:3.1::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.2 |
cpe:/a:redhat:service_mesh:3.2::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3.3 |
cpe:/a:redhat:service_mesh:3.3::el9 |
|
| Red Hat | Red Hat OpenShift Service Mesh 3 |
cpe:/a:redhat:service_mesh:3.0::el9 |
|
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
cpe:/a:redhat:trusted_artifact_signer:1.4::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.6 |
cpe:/a:redhat:multicluster_engine:2.6::el8 |
|
| Red Hat | multicluster engine for Kubernetes 2.8 |
cpe:/a:redhat:multicluster_engine:2.8::el9 |
|
| Red Hat | multicluster engine for Kubernetes 2.9 |
cpe:/a:redhat:multicluster_engine:2.9::el9 |
|
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 |
cpe:/a:redhat:assisted_installer:2 |
|
| Red Hat | cert-manager Operator for Red Hat OpenShift |
cpe:/a:redhat:cert_manager:1 |
|
| Red Hat | Compliance Operator |
cpe:/a:redhat:openshift_compliance_operator:1 |
|
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1 |
|
| Red Hat | Deployment Validation Operator |
cpe:/a:redhat:deployment_validator_operator |
|
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1 |
|
| Red Hat | Fence Agents Remediation Operator |
cpe:/a:redhat:workload_availability_far:0 |
|
| Red Hat | File Integrity Operator |
cpe:/a:redhat:openshift_file_integrity_operator:1 |
|
| Red Hat | Gatekeeper 3 |
cpe:/a:redhat:gatekeeper:3 |
|
| Red Hat | Logical Volume Manager Storage |
cpe:/a:redhat:lvms:4 |
|
| Red Hat | Machine Deletion Remediation Operator |
cpe:/a:redhat:workload_availability_mdr:0 |
|
| Red Hat | Migration Toolkit for Applications 8 |
cpe:/a:redhat:migration_toolkit_applications:8 |
|
| Red Hat | Migration Toolkit for Containers |
cpe:/a:redhat:rhmt:1 |
|
| Red Hat | Multiarch Tuning Operator |
cpe:/a:redhat:multiarch_tuning_operator |
|
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine |
|
| Red Hat | Multicluster Global Hub |
cpe:/a:redhat:multicluster_globalhub |
|
| Red Hat | Network Observability Operator |
cpe:/a:redhat:network_observ_optr:1 |
|
| Red Hat | Node HealthCheck Operator |
cpe:/a:redhat:workload_availability_nhc:0 |
|
| Red Hat | OpenShift API for Data Protection |
cpe:/a:redhat:openshift_api_data_protection:1 |
|
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools |
|
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed |
|
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1 |
|
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1 |
|
| Red Hat | Power monitoring for Red Hat OpenShift |
cpe:/a:redhat:openshift_power_monitoring |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 |
cpe:/a:redhat:acm:2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat Ceph Storage 5 |
cpe:/a:redhat:ceph_storage:5 |
|
| Red Hat | Red Hat Ceph Storage 6 |
cpe:/a:redhat:ceph_storage:6 |
|
| Red Hat | Red Hat Ceph Storage 8 |
cpe:/a:redhat:ceph_storage:8 |
|
| Red Hat | Red Hat Ceph Storage 9 |
cpe:/a:redhat:ceph_storage:9 |
|
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 |
cpe:/a:redhat:certifications:9 |
|
| Red Hat | Red Hat Connectivity Link 1 |
cpe:/a:redhat:connectivity_link:1 |
|
| Red Hat | Red Hat Developer Hub |
cpe:/a:redhat:rhdh:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3 |
|
| Red Hat | Red Hat Lightspeed for Runtimes Operator |
cpe:/a:redhat:lightspeed_for_runtimes:1 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift Cluster Manager CLI |
cpe:/a:redhat:openshift_cluster_manager_cli:1 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat OpenShift for Windows Containers |
cpe:/a:redhat:windows_machine_config |
|
| Red Hat | Red Hat OpenShift on AWS |
cpe:/a:redhat:openshift_service_on_aws:1 |
|
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4 |
|
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2 |
|
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1 |
|
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
|
| Red Hat | Red Hat Web Terminal |
cpe:/a:redhat:webterminal:1 |
|
| Red Hat | Security Profiles Operator |
cpe:/a:redhat:openshift_security_profiles_operator:1 |
|
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3 |
|
| Red Hat | Zero Trust Workload Identity Manager |
cpe:/a:redhat:zero_trust_workload_identity_manager:1 |
|
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
cpe:/a:redhat:zero_trust_workload_identity_manager:0 |
|
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4 |
|
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0 |
|
| Red Hat | Red Hat Service Interconnect 1 |
cpe:/a:redhat:service_interconnect:1 |
|
| Red Hat | Red Hat Service Interconnect 2 |
cpe:/a:redhat:service_interconnect:2 |
Credits
KC1zs4 (https://github.com/KC1zs4)
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-39821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-23T03:55:58.522682Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1289",
"description": "CWE-1289 Improper Validation of Unsafe Equivalence in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T13:13:15.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:openshift:4.22::el8",
"cpe:/a:redhat:openshift:4.22::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4.22",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:edge_manager:1.0::el9"
],
"defaultStatus": "affected",
"product": "RHEM 1.0 for RHEL 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"defaultStatus": "affected",
"product": "Cluster Observability Operator 1.5.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:devworkspace:0.42::el9"
],
"defaultStatus": "affected",
"product": "DevWorkspace Operator 0.42",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:logging:6.4::el9"
],
"defaultStatus": "affected",
"product": "Logging Subsystem for Red Hat OpenShift 6.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.11::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.11",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:edge_manager:1.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Edge Manager 1.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.4::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AI 3.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_builds:1.7::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Builds 1.7.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.19::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps 1.19",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.20::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift GitOps 1.20",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:2.6::el8"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.1::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.2::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.3::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3.3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_mesh:3.0::el9"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "affected",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el8"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"defaultStatus": "affected",
"product": "multicluster engine for Kubernetes 2.9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:assisted_installer:2"
],
"defaultStatus": "affected",
"product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cert_manager:1"
],
"defaultStatus": "affected",
"product": "cert-manager Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_compliance_operator:1"
],
"defaultStatus": "affected",
"product": "Compliance Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:deployment_validator_operator"
],
"defaultStatus": "affected",
"product": "Deployment Validation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "affected",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_far:0"
],
"defaultStatus": "affected",
"product": "Fence Agents Remediation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_file_integrity_operator:1"
],
"defaultStatus": "affected",
"product": "File Integrity Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:gatekeeper:3"
],
"defaultStatus": "affected",
"product": "Gatekeeper 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_mdr:0"
],
"defaultStatus": "affected",
"product": "Machine Deletion Remediation Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhmt:1"
],
"defaultStatus": "affected",
"product": "Migration Toolkit for Containers",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multiarch_tuning_operator"
],
"defaultStatus": "affected",
"product": "Multiarch Tuning Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_globalhub"
],
"defaultStatus": "affected",
"product": "Multicluster Global Hub",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:network_observ_optr:1"
],
"defaultStatus": "affected",
"product": "Network Observability Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:workload_availability_nhc:0"
],
"defaultStatus": "affected",
"product": "Node HealthCheck Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1"
],
"defaultStatus": "affected",
"product": "OpenShift API for Data Protection",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_power_monitoring"
],
"defaultStatus": "affected",
"product": "Power monitoring for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "affected",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ceph_storage:5"
],
"defaultStatus": "affected",
"product": "Red Hat Ceph Storage 5",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ceph_storage:6"
],
"defaultStatus": "affected",
"product": "Red Hat Ceph Storage 6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ceph_storage:8"
],
"defaultStatus": "affected",
"product": "Red Hat Ceph Storage 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
],
"defaultStatus": "affected",
"product": "Red Hat Ceph Storage 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:certifications:9"
],
"defaultStatus": "affected",
"product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:connectivity_link:1"
],
"defaultStatus": "affected",
"product": "Red Hat Connectivity Link 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:rhdh:1"
],
"defaultStatus": "affected",
"product": "Red Hat Developer Hub",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:lightspeed_for_runtimes:1"
],
"defaultStatus": "affected",
"product": "Red Hat Lightspeed for Runtimes Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_cluster_manager_cli:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Cluster Manager CLI",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:windows_machine_config"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift for Windows Containers",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_service_on_aws:1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift on AWS",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "affected",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "affected",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:webterminal:1"
],
"defaultStatus": "affected",
"product": "Red Hat Web Terminal",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openshift_security_profiles_operator:1"
],
"defaultStatus": "affected",
"product": "Security Profiles Operator",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:1"
],
"defaultStatus": "affected",
"product": "Zero Trust Workload Identity Manager",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "unaffected",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_interconnect:1"
],
"defaultStatus": "unaffected",
"product": "Red Hat Service Interconnect 1",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:service_interconnect:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat Service Interconnect 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-22T15:01:21.462Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1289",
"description": "Improper Validation of Unsafe Equivalence in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T12:05:36.478Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"name": "RHBZ#2480756",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34789"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30855"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35827"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35826"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34357"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30853"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35830"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35831"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30854"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35828"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35829"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34359"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34342"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36808"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34364"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30651"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26547"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36207"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26546"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36651"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33531"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33524"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23262"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23264"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36648"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36820"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35994"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35993"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33155"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33163"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33173"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33183"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33160"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37387"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36797"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36105"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36167"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30650"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36883"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:34789: Red Hat OpenShift Container Platform 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:30855: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:35827: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:35826: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:34357: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:30853: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:35830: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:35831: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:30854: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:35828: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:35829: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:34359: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
},
{
"lang": "en",
"value": "RHSA-2026:36808: DevWorkspace Operator 0.42"
},
{
"lang": "en",
"value": "RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4"
},
{
"lang": "en",
"value": "RHSA-2026:30651: Red Hat Advanced Cluster Management for Kubernetes 2.13"
},
{
"lang": "en",
"value": "RHSA-2026:26547: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11"
},
{
"lang": "en",
"value": "RHSA-2026:26546: Red Hat Advanced Cluster Security for Kubernetes 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:36651: Red Hat Edge Manager 1.0"
},
{
"lang": "en",
"value": "RHSA-2026:33531: Red Hat Enterprise Linux AI 3.4"
},
{
"lang": "en",
"value": "RHSA-2026:33524: Red Hat Enterprise Linux AI 3.4"
},
{
"lang": "en",
"value": "RHSA-2026:23262: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:23264: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.4"
},
{
"lang": "en",
"value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
},
{
"lang": "en",
"value": "RHSA-2026:35994: Red Hat OpenShift GitOps 1.19"
},
{
"lang": "en",
"value": "RHSA-2026:35993: Red Hat OpenShift GitOps 1.20"
},
{
"lang": "en",
"value": "RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:33160: Red Hat OpenShift Service Mesh 3"
},
{
"lang": "en",
"value": "RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:36105: multicluster engine for Kubernetes 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:36167: multicluster engine for Kubernetes 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:30650: multicluster engine for Kubernetes 2.8"
},
{
"lang": "en",
"value": "RHSA-2026:36883: multicluster engine for Kubernetes 2.9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-22T16:00:52.844Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-22T15:01:21.462Z",
"value": "Made public."
}
],
"title": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"workarounds": [
{
"lang": "en",
"value": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/net/idna",
"product": "golang.org/x/net/idna",
"programRoutines": [
{
"name": "Profile.process"
},
{
"name": "Profile.ToASCII"
},
{
"name": "Profile.ToUnicode"
},
{
"name": "ToASCII"
},
{
"name": "ToUnicode"
}
],
"vendor": "golang.org/x/net",
"versions": [
{
"lessThan": "0.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "KC1zs4 (https://github.com/KC1zs4)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T15:01:21.462Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/767220"
},
{
"url": "https://go.dev/issue/78760"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"title": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-39821",
"datePublished": "2026-05-22T15:01:21.462Z",
"dateReserved": "2026-04-07T18:13:03.526Z",
"dateUpdated": "2026-07-10T12:05:36.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-39821",
"date": "2026-07-10",
"epss": "0.00478",
"percentile": "0.37952"
},
"microsoft_vex": {
"current_release_date": "2026-06-19T14:40:22.000Z",
"cve": "CVE-2026-39821",
"id": "msrc_CVE-2026-39821",
"initial_release_date": "2026-05-02T00:00:00.000Z",
"product_status:fixed": "50",
"product_status:known_affected": "52",
"product_status:known_not_affected": "4",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-39821.json",
"version": "11"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-39821\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-05-22T16:16:20.410\",\"lastModified\":\"2026-07-10T12:16:44.313\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\\\"xn--example-.com\\\") incorrectly returns the name \\\"example.com\\\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \\\"example.com\\\" but permit \\\"xn--example-.com\\\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \\\"example.com\\\".\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"golang.org/x/net\",\"product\":\"golang.org/x/net/idna\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"golang.org/x/net/idna\",\"programRoutines\":[{\"name\":\"Profile.process\"},{\"name\":\"Profile.ToASCII\"},{\"name\":\"Profile.ToUnicode\"},{\"name\":\"ToASCII\"},{\"name\":\"ToUnicode\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.55.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.22\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4.22::el8\",\"cpe:/a:redhat:openshift:4.22::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.0 for RHEL 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cluster Observability Operator 1.5.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cluster_observability_operator:1.5::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"DevWorkspace Operator 0.42\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:devworkspace:0.42::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:logging:6.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.13\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2.13::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.11\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1.0\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.7.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.7::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.29\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.19\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.19::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.20\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2.6::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.2::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3.3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Service Mesh 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.6::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.9::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Assisted Installer for Red Hat OpenShift Container Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:assisted_installer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"cert-manager Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:cert_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Compliance Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_compliance_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Deployment Validation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:deployment_validator_operator\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Fence Agents Remediation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_far:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"File Integrity Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_file_integrity_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Gatekeeper 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:gatekeeper:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Machine Deletion Remediation Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_mdr:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Containers\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhmt:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multiarch Tuning Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multiarch_tuning_operator\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Node HealthCheck Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:workload_availability_nhc:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Power monitoring for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_power_monitoring\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 5\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:certifications:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Connectivity Link 1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:connectivity_link:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:rhdh:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Lightspeed for Runtimes Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:lightspeed_for_runtimes:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Cluster Manager CLI\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift for Windows Containers\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:windows_machine_config\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift on AWS\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_service_on_aws:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:webterminal:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Security Profiles Operator\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_security_profiles_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 1\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 2\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:2\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":5.8},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.8}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-23T03:55:58.522682Z\",\"id\":\"CVE-2026-39821\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1289\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1289\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"0.55.0\",\"matchCriteriaId\":\"38C86E7B-A1CA-4670-B113-FC9585261F6F\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/767220\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://go.dev/issue/78760\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-5026\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23262\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23264\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26546\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26547\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30650\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30651\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30853\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30854\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30855\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33155\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33160\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33163\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33173\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33183\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33524\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33531\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34342\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34357\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34359\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34364\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34789\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35826\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35827\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35828\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35829\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35830\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35831\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35993\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35994\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36105\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36167\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36207\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36648\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36651\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36797\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36808\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36820\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36883\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37387\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-39821\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2480756\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-10T16:47:01+00:00",
"cve": "CVE-2026-39821",
"id": "CVE-2026-39821",
"initial_release_date": "2026-05-22T15:01:21.462000+00:00",
"product_status:fixed": "526",
"product_status:known_affected": "276",
"product_status:known_not_affected": "1001",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:openshift:4.22::el8\", \"cpe:/a:redhat:openshift:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.22\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cluster_observability_operator:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cluster Observability Operator 1.5.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.11\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.7.4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.19::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.20\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.0\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Service Mesh 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:assisted_installer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Assisted Installer for Red Hat OpenShift Container Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cert_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"cert-manager Operator for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_compliance_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Compliance Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:deployment_validator_operator\"], \"vendor\": \"Red Hat\", \"product\": \"Deployment Validation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_far:0\"], \"vendor\": \"Red Hat\", \"product\": \"Fence Agents Remediation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_file_integrity_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"File Integrity Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:gatekeeper:3\"], \"vendor\": \"Red Hat\", \"product\": \"Gatekeeper 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_mdr:0\"], \"vendor\": \"Red Hat\", \"product\": \"Machine Deletion Remediation Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Containers\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multiarch_tuning_operator\"], \"vendor\": \"Red Hat\", \"product\": \"Multiarch Tuning Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_nhc:0\"], \"vendor\": \"Red Hat\", \"product\": \"Node HealthCheck Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_power_monitoring\"], \"vendor\": \"Red Hat\", \"product\": \"Power monitoring for Red Hat OpenShift\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:5\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 5\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:connectivity_link:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Connectivity Link 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_for_runtimes:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Lightspeed for Runtimes Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Cluster Manager CLI\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Workspaces Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:windows_machine_config\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift for Windows Containers\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_service_on_aws:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift on AWS\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_security_profiles_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Security Profiles Operator\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 1\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 2\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-22T16:00:52.844Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-22T15:01:21.462Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:34789: Red Hat OpenShift Container Platform 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30855: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35827: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35826: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34357: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30853: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35830: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35831: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30854: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35828: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35829: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34359: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34342: Cluster Observability Operator 1.5.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30651: Red Hat Advanced Cluster Management for Kubernetes 2.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26547: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26546: Red Hat Advanced Cluster Security for Kubernetes 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33531: Red Hat Enterprise Linux AI 3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33524: Red Hat Enterprise Linux AI 3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23262: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23264: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36648: Red Hat OpenShift Builds 1.7.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35994: Red Hat OpenShift GitOps 1.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35993: Red Hat OpenShift GitOps 1.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33160: Red Hat OpenShift Service Mesh 3.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36105: multicluster engine for Kubernetes 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36167: multicluster engine for Kubernetes 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30650: multicluster engine for Kubernetes 2.8\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-22T15:01:21.462Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-39821\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2480756\", \"name\": \"RHBZ#2480756\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34789\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30855\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35827\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35826\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34357\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30853\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35830\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35831\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30854\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35828\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35829\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34359\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34342\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34364\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30651\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26547\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36207\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26546\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33531\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33524\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23262\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23264\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36648\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35994\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35993\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33155\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33160\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33163\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33173\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33183\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36105\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36167\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30650\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1289\", \"description\": \"Improper Validation of Unsafe Equivalence in Input\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-08T12:05:44.075Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39821\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-23T03:55:58.522682Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1289\", \"description\": \"CWE-1289 Improper Validation of Unsafe Equivalence in Input\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-22T18:01:10.401Z\"}}], \"cna\": {\"title\": \"Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna\", \"credits\": [{\"lang\": \"en\", \"value\": \"KC1zs4 (https://github.com/KC1zs4)\"}], \"affected\": [{\"vendor\": \"golang.org/x/net\", \"product\": \"golang.org/x/net/idna\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.55.0\", \"versionType\": \"semver\"}], \"packageName\": \"golang.org/x/net/idna\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"Profile.process\"}, {\"name\": \"Profile.ToASCII\"}, {\"name\": \"Profile.ToUnicode\"}, {\"name\": \"ToASCII\"}, {\"name\": \"ToUnicode\"}]}], \"references\": [{\"url\": \"https://go.dev/cl/767220\"}, {\"url\": \"https://go.dev/issue/78760\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-5026\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\\\"xn--example-.com\\\") incorrectly returns the name \\\"example.com\\\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \\\"example.com\\\" but permit \\\"xn--example-.com\\\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \\\"example.com\\\".\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-1289: Improper Validation of Unsafe Equivalence in Input\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-05-22T15:01:21.462Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-39821\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-08T12:05:44.075Z\", \"dateReserved\": \"2026-04-07T18:13:03.526Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-05-22T15:01:21.462Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:37435
Vulnerability from csaf_redhat - Published: 2026-07-09 20:07 - Updated: 2026-07-10 16:54Summary
Red Hat Security Advisory: golang security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for golang is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The golang packages provide the Go programming language compiler.
Security Fix(es):
* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.5+1 [rhel-9.8.z] (JIRA:RHEL-193476)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
7.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
22 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)\n\nBug Fix(es) and Enhancement(s):\n\n* Update Go to version 1.26.5+1 [rhel-9.8.z] (JIRA:RHEL-193476)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:37435",
"url": "https://access.redhat.com/errata/RHSA-2026:37435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "RHEL-193476",
"url": "https://issues.redhat.com/browse/RHEL-193476"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37435.json"
}
],
"title": "Red Hat Security Advisory: golang security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-07-10T16:54:35+00:00",
"generator": {
"date": "2026-07-10T16:54:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.2"
}
},
"id": "RHSA-2026:37435",
"initial_release_date": "2026-07-09T20:07:34+00:00",
"revision_history": [
{
"date": "2026-07-09T20:07:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-09T20:07:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-10T16:54:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el9_8.aarch64",
"product": {
"name": "go-toolset-0:1.26.5-1.el9_8.aarch64",
"product_id": "go-toolset-0:1.26.5-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el9_8.aarch64",
"product": {
"name": "golang-0:1.26.5-1.el9_8.aarch64",
"product_id": "golang-0:1.26.5-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el9_8.aarch64",
"product": {
"name": "golang-bin-0:1.26.5-1.el9_8.aarch64",
"product_id": "golang-bin-0:1.26.5-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el9_8.aarch64",
"product": {
"name": "golang-race-0:1.26.5-1.el9_8.aarch64",
"product_id": "golang-race-0:1.26.5-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
"product": {
"name": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
"product_id": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el9_8.ppc64le",
"product": {
"name": "golang-0:1.26.5-1.el9_8.ppc64le",
"product_id": "golang-0:1.26.5-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
"product": {
"name": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
"product_id": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el9_8.ppc64le",
"product": {
"name": "golang-race-0:1.26.5-1.el9_8.ppc64le",
"product_id": "golang-race-0:1.26.5-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el9_8.x86_64",
"product": {
"name": "go-toolset-0:1.26.5-1.el9_8.x86_64",
"product_id": "go-toolset-0:1.26.5-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el9_8.x86_64",
"product": {
"name": "golang-0:1.26.5-1.el9_8.x86_64",
"product_id": "golang-0:1.26.5-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el9_8.x86_64",
"product": {
"name": "golang-bin-0:1.26.5-1.el9_8.x86_64",
"product_id": "golang-bin-0:1.26.5-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el9_8.x86_64",
"product": {
"name": "golang-race-0:1.26.5-1.el9_8.x86_64",
"product_id": "golang-race-0:1.26.5-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el9_8.s390x",
"product": {
"name": "go-toolset-0:1.26.5-1.el9_8.s390x",
"product_id": "go-toolset-0:1.26.5-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el9_8.s390x",
"product": {
"name": "golang-0:1.26.5-1.el9_8.s390x",
"product_id": "golang-0:1.26.5-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el9_8.s390x",
"product": {
"name": "golang-bin-0:1.26.5-1.el9_8.s390x",
"product_id": "golang-bin-0:1.26.5-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el9_8.s390x",
"product": {
"name": "golang-race-0:1.26.5-1.el9_8.s390x",
"product_id": "golang-race-0:1.26.5-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el9_8.src",
"product": {
"name": "golang-0:1.26.5-1.el9_8.src",
"product_id": "golang-0:1.26.5-1.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-docs-0:1.26.5-1.el9_8.noarch",
"product": {
"name": "golang-docs-0:1.26.5-1.el9_8.noarch",
"product_id": "golang-docs-0:1.26.5-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-docs@1.26.5-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-misc-0:1.26.5-1.el9_8.noarch",
"product": {
"name": "golang-misc-0:1.26.5-1.el9_8.noarch",
"product_id": "golang-misc-0:1.26.5-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-misc@1.26.5-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-src-0:1.26.5-1.el9_8.noarch",
"product": {
"name": "golang-src-0:1.26.5-1.el9_8.noarch",
"product_id": "golang-src-0:1.26.5-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-src@1.26.5-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-tests-0:1.26.5-1.el9_8.noarch",
"product": {
"name": "golang-tests-0:1.26.5-1.el9_8.noarch",
"product_id": "golang-tests-0:1.26.5-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-tests@1.26.5-1.el9_8?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64"
},
"product_reference": "go-toolset-0:1.26.5-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le"
},
"product_reference": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x"
},
"product_reference": "go-toolset-0:1.26.5-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64"
},
"product_reference": "go-toolset-0:1.26.5-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64"
},
"product_reference": "golang-0:1.26.5-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le"
},
"product_reference": "golang-0:1.26.5-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x"
},
"product_reference": "golang-0:1.26.5-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src"
},
"product_reference": "golang-0:1.26.5-1.el9_8.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64"
},
"product_reference": "golang-0:1.26.5-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64"
},
"product_reference": "golang-bin-0:1.26.5-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le"
},
"product_reference": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x"
},
"product_reference": "golang-bin-0:1.26.5-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64"
},
"product_reference": "golang-bin-0:1.26.5-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-docs-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch"
},
"product_reference": "golang-docs-0:1.26.5-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-misc-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch"
},
"product_reference": "golang-misc-0:1.26.5-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64"
},
"product_reference": "golang-race-0:1.26.5-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le"
},
"product_reference": "golang-race-0:1.26.5-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x"
},
"product_reference": "golang-race-0:1.26.5-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64"
},
"product_reference": "golang-race-0:1.26.5-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-src-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch"
},
"product_reference": "golang-src-0:1.26.5-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-tests-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
},
"product_reference": "golang-tests-0:1.26.5-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T20:07:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:37435"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39822",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-08T17:01:53.592869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "RHBZ#2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://go.dev/cl/797880",
"url": "https://go.dev/cl/797880"
},
{
"category": "external",
"summary": "https://go.dev/issue/79005",
"url": "https://go.dev/issue/79005"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4970",
"url": "https://pkg.go.dev/vuln/GO-2026-4970"
}
],
"release_date": "2026-07-08T15:46:27.199000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T20:07:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:37435"
},
{
"category": "workaround",
"details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal"
}
]
}
RHSA-2026:37436
Vulnerability from csaf_redhat - Published: 2026-07-09 19:54 - Updated: 2026-07-10 16:56Summary
Red Hat Security Advisory: golang security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for golang is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The golang packages provide the Go programming language compiler.
Security Fix(es):
* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.5+1 [rhel-10.2.z] (JIRA:RHEL-193473)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
7.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
22 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for golang is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)\n\nBug Fix(es) and Enhancement(s):\n\n* Update Go to version 1.26.5+1 [rhel-10.2.z] (JIRA:RHEL-193473)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:37436",
"url": "https://access.redhat.com/errata/RHSA-2026:37436"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "RHEL-193473",
"url": "https://issues.redhat.com/browse/RHEL-193473"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37436.json"
}
],
"title": "Red Hat Security Advisory: golang security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-07-10T16:56:23+00:00",
"generator": {
"date": "2026-07-10T16:56:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.2"
}
},
"id": "RHSA-2026:37436",
"initial_release_date": "2026-07-09T19:54:04+00:00",
"revision_history": [
{
"date": "2026-07-09T19:54:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-09T19:54:04+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-10T16:56:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_2.aarch64",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_2.aarch64",
"product_id": "go-toolset-0:1.26.5-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_2.aarch64",
"product": {
"name": "golang-0:1.26.5-1.el10_2.aarch64",
"product_id": "golang-0:1.26.5-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_2.aarch64",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_2.aarch64",
"product_id": "golang-bin-0:1.26.5-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_2.aarch64",
"product": {
"name": "golang-race-0:1.26.5-1.el10_2.aarch64",
"product_id": "golang-race-0:1.26.5-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_2.ppc64le",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_2.ppc64le",
"product_id": "go-toolset-0:1.26.5-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_2.ppc64le",
"product": {
"name": "golang-0:1.26.5-1.el10_2.ppc64le",
"product_id": "golang-0:1.26.5-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_2.ppc64le",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_2.ppc64le",
"product_id": "golang-bin-0:1.26.5-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_2.ppc64le",
"product": {
"name": "golang-race-0:1.26.5-1.el10_2.ppc64le",
"product_id": "golang-race-0:1.26.5-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_2.s390x",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_2.s390x",
"product_id": "go-toolset-0:1.26.5-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_2.s390x",
"product": {
"name": "golang-0:1.26.5-1.el10_2.s390x",
"product_id": "golang-0:1.26.5-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_2.s390x",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_2.s390x",
"product_id": "golang-bin-0:1.26.5-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_2.s390x",
"product": {
"name": "golang-race-0:1.26.5-1.el10_2.s390x",
"product_id": "golang-race-0:1.26.5-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_2.x86_64",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_2.x86_64",
"product_id": "go-toolset-0:1.26.5-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_2.x86_64",
"product": {
"name": "golang-0:1.26.5-1.el10_2.x86_64",
"product_id": "golang-0:1.26.5-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_2.x86_64",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_2.x86_64",
"product_id": "golang-bin-0:1.26.5-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_2.x86_64",
"product": {
"name": "golang-race-0:1.26.5-1.el10_2.x86_64",
"product_id": "golang-race-0:1.26.5-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_2.src",
"product": {
"name": "golang-0:1.26.5-1.el10_2.src",
"product_id": "golang-0:1.26.5-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-docs-0:1.26.5-1.el10_2.noarch",
"product": {
"name": "golang-docs-0:1.26.5-1.el10_2.noarch",
"product_id": "golang-docs-0:1.26.5-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-docs@1.26.5-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-misc-0:1.26.5-1.el10_2.noarch",
"product": {
"name": "golang-misc-0:1.26.5-1.el10_2.noarch",
"product_id": "golang-misc-0:1.26.5-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-misc@1.26.5-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-src-0:1.26.5-1.el10_2.noarch",
"product": {
"name": "golang-src-0:1.26.5-1.el10_2.noarch",
"product_id": "golang-src-0:1.26.5-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-src@1.26.5-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-tests-0:1.26.5-1.el10_2.noarch",
"product": {
"name": "golang-tests-0:1.26.5-1.el10_2.noarch",
"product_id": "golang-tests-0:1.26.5-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-tests@1.26.5-1.el10_2?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64"
},
"product_reference": "golang-0:1.26.5-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le"
},
"product_reference": "golang-0:1.26.5-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x"
},
"product_reference": "golang-0:1.26.5-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src"
},
"product_reference": "golang-0:1.26.5-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64"
},
"product_reference": "golang-0:1.26.5-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-docs-0:1.26.5-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch"
},
"product_reference": "golang-docs-0:1.26.5-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-misc-0:1.26.5-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch"
},
"product_reference": "golang-misc-0:1.26.5-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64"
},
"product_reference": "golang-race-0:1.26.5-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le"
},
"product_reference": "golang-race-0:1.26.5-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x"
},
"product_reference": "golang-race-0:1.26.5-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64"
},
"product_reference": "golang-race-0:1.26.5-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-src-0:1.26.5-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch"
},
"product_reference": "golang-src-0:1.26.5-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-tests-0:1.26.5-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
},
"product_reference": "golang-tests-0:1.26.5-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T19:54:04+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:37436"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39822",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-08T17:01:53.592869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "RHBZ#2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://go.dev/cl/797880",
"url": "https://go.dev/cl/797880"
},
{
"category": "external",
"summary": "https://go.dev/issue/79005",
"url": "https://go.dev/issue/79005"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4970",
"url": "https://pkg.go.dev/vuln/GO-2026-4970"
}
],
"release_date": "2026-07-08T15:46:27.199000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T19:54:04+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:37436"
},
{
"category": "workaround",
"details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
"product_ids": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:go-toolset-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.src",
"AppStream-10.2.Z:golang-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-bin-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-docs-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-misc-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.aarch64",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.ppc64le",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.s390x",
"AppStream-10.2.Z:golang-race-0:1.26.5-1.el10_2.x86_64",
"AppStream-10.2.Z:golang-src-0:1.26.5-1.el10_2.noarch",
"AppStream-10.2.Z:golang-tests-0:1.26.5-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal"
}
]
}
SUSE-OU-2016:2857-1
Vulnerability from csaf_suse - Published: 2016-11-05 07:01 - Updated: 2016-11-05 07:01Summary
Add headmore to SUSE PackageHub
Severity
Low
Notes
Title of the patch: Add headmore to SUSE PackageHub
Description of the patch: This update makes headmore available in the SUSE Package Hub.
headmore is a VNC client for character terminals.
Patchnames: 1006
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 12:headmore-1.1.1-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:headmore-1.1.1-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:headmore-1.1.1-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:headmore-1.1.1-2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:helm-3.21.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:helm-3.21.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:helm-3.21.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:helm-bash-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:helm-fish-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:helm-zsh-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:headmore-1.1.1-2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:headmore-1.1.1-2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:headmore-1.1.1-2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:headmore-1.1.1-2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:helm-bash-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:helm-fish-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE:SLFO:1.2:helm-zsh-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Add headmore to SUSE PackageHub",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update makes headmore available in the SUSE Package Hub.\n\nheadmore is a VNC client for character terminals.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "1006",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-ou-2016_2857-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-OU-2016:2857-1",
"url": "https://www.suse.com/support/update/announcement//suse-ou-20162857-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-OU-2016:2857-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2016-November/005472.html"
},
{
"category": "self",
"summary": "SUSE Bug 1266598",
"url": "https://bugzilla.suse.com/1266598"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
}
],
"title": "Add headmore to SUSE PackageHub",
"tracking": {
"current_release_date": "2016-11-05T07:01:12Z",
"generator": {
"date": "2016-11-05T07:01:12Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-OU-2016:2857-1",
"initial_release_date": "2016-11-05T07:01:12Z",
"revision_history": [
{
"date": "2016-11-05T07:01:12Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "headmore-1.1.1-2.1.aarch64",
"product": {
"name": "headmore-1.1.1-2.1.aarch64",
"product_id": "headmore-1.1.1-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "helm-3.21.1-160000.1.1.aarch64",
"product": {
"name": "helm-3.21.1-160000.1.1.aarch64",
"product_id": "helm-3.21.1-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"product": {
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"product_id": "helm-bash-completion-3.21.1-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "helm-fish-completion-3.21.1-160000.1.1.noarch",
"product": {
"name": "helm-fish-completion-3.21.1-160000.1.1.noarch",
"product_id": "helm-fish-completion-3.21.1-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "helm-zsh-completion-3.21.1-160000.1.1.noarch",
"product": {
"name": "helm-zsh-completion-3.21.1-160000.1.1.noarch",
"product_id": "helm-zsh-completion-3.21.1-160000.1.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "headmore-1.1.1-2.1.ppc64le",
"product": {
"name": "headmore-1.1.1-2.1.ppc64le",
"product_id": "headmore-1.1.1-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "helm-3.21.1-160000.1.1.ppc64le",
"product": {
"name": "helm-3.21.1-160000.1.1.ppc64le",
"product_id": "helm-3.21.1-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "headmore-1.1.1-2.1.s390x",
"product": {
"name": "headmore-1.1.1-2.1.s390x",
"product_id": "headmore-1.1.1-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "headmore-1.1.1-2.1.x86_64",
"product": {
"name": "headmore-1.1.1-2.1.x86_64",
"product_id": "headmore-1.1.1-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "helm-3.21.1-160000.1.1.x86_64",
"product": {
"name": "helm-3.21.1-160000.1.1.x86_64",
"product_id": "helm-3.21.1-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 12",
"product": {
"name": "SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:12"
}
}
},
{
"category": "product_name",
"name": "SUSE:SLFO:1.2",
"product": {
"name": "SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.aarch64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:headmore-1.1.1-2.1.aarch64"
},
"product_reference": "headmore-1.1.1-2.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.ppc64le as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:headmore-1.1.1-2.1.ppc64le"
},
"product_reference": "headmore-1.1.1-2.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.s390x as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:headmore-1.1.1-2.1.s390x"
},
"product_reference": "headmore-1.1.1-2.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.x86_64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:headmore-1.1.1-2.1.x86_64"
},
"product_reference": "headmore-1.1.1-2.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.aarch64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:helm-3.21.1-160000.1.1.aarch64"
},
"product_reference": "helm-3.21.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.ppc64le as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:helm-3.21.1-160000.1.1.ppc64le"
},
"product_reference": "helm-3.21.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.x86_64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:helm-3.21.1-160000.1.1.x86_64"
},
"product_reference": "helm-3.21.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:helm-bash-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-fish-completion-3.21.1-160000.1.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:helm-fish-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-fish-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-zsh-completion-3.21.1-160000.1.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:helm-zsh-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-zsh-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.aarch64 as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:headmore-1.1.1-2.1.aarch64"
},
"product_reference": "headmore-1.1.1-2.1.aarch64",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.ppc64le as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:headmore-1.1.1-2.1.ppc64le"
},
"product_reference": "headmore-1.1.1-2.1.ppc64le",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.s390x as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:headmore-1.1.1-2.1.s390x"
},
"product_reference": "headmore-1.1.1-2.1.s390x",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "headmore-1.1.1-2.1.x86_64 as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:headmore-1.1.1-2.1.x86_64"
},
"product_reference": "headmore-1.1.1-2.1.x86_64",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.aarch64 as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.aarch64"
},
"product_reference": "helm-3.21.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.ppc64le as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.ppc64le"
},
"product_reference": "helm-3.21.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.x86_64 as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.x86_64"
},
"product_reference": "helm-3.21.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:helm-bash-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-fish-completion-3.21.1-160000.1.1.noarch as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:helm-fish-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-fish-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE:SLFO:1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-zsh-completion-3.21.1-160000.1.1.noarch as component of SUSE:SLFO:1.2",
"product_id": "SUSE:SLFO:1.2:helm-zsh-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-zsh-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE:SLFO:1.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:headmore-1.1.1-2.1.aarch64",
"SUSE Package Hub 12:headmore-1.1.1-2.1.ppc64le",
"SUSE Package Hub 12:headmore-1.1.1-2.1.s390x",
"SUSE Package Hub 12:headmore-1.1.1-2.1.x86_64",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.aarch64",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.ppc64le",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.x86_64",
"SUSE Package Hub 12:helm-bash-completion-3.21.1-160000.1.1.noarch",
"SUSE Package Hub 12:helm-fish-completion-3.21.1-160000.1.1.noarch",
"SUSE Package Hub 12:helm-zsh-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.aarch64",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.ppc64le",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.s390x",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.x86_64",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.aarch64",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.ppc64le",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.x86_64",
"SUSE:SLFO:1.2:helm-bash-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:helm-fish-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:helm-zsh-completion-3.21.1-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:headmore-1.1.1-2.1.aarch64",
"SUSE Package Hub 12:headmore-1.1.1-2.1.ppc64le",
"SUSE Package Hub 12:headmore-1.1.1-2.1.s390x",
"SUSE Package Hub 12:headmore-1.1.1-2.1.x86_64",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.aarch64",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.ppc64le",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.x86_64",
"SUSE Package Hub 12:helm-bash-completion-3.21.1-160000.1.1.noarch",
"SUSE Package Hub 12:helm-fish-completion-3.21.1-160000.1.1.noarch",
"SUSE Package Hub 12:helm-zsh-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.aarch64",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.ppc64le",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.s390x",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.x86_64",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.aarch64",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.ppc64le",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.x86_64",
"SUSE:SLFO:1.2:helm-bash-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:helm-fish-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:helm-zsh-completion-3.21.1-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:headmore-1.1.1-2.1.aarch64",
"SUSE Package Hub 12:headmore-1.1.1-2.1.ppc64le",
"SUSE Package Hub 12:headmore-1.1.1-2.1.s390x",
"SUSE Package Hub 12:headmore-1.1.1-2.1.x86_64",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.aarch64",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.ppc64le",
"SUSE Package Hub 12:helm-3.21.1-160000.1.1.x86_64",
"SUSE Package Hub 12:helm-bash-completion-3.21.1-160000.1.1.noarch",
"SUSE Package Hub 12:helm-fish-completion-3.21.1-160000.1.1.noarch",
"SUSE Package Hub 12:helm-zsh-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.aarch64",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.ppc64le",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.s390x",
"SUSE:SLFO:1.2:headmore-1.1.1-2.1.x86_64",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.aarch64",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.ppc64le",
"SUSE:SLFO:1.2:helm-3.21.1-160000.1.1.x86_64",
"SUSE:SLFO:1.2:helm-bash-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:helm-fish-completion-3.21.1-160000.1.1.noarch",
"SUSE:SLFO:1.2:helm-zsh-completion-3.21.1-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-11-05T07:01:12Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
}
]
}
SUSE-SU-2026:22066-1
Vulnerability from csaf_suse - Published: 2026-06-10 08:12 - Updated: 2026-06-10 08:12Summary
Security update for elemental-operator
Severity
Important
Notes
Title of the patch: Security update for elemental-operator
Description of the patch: This update for elemental-operator fixes the following issue
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260277).
Changes for elemental-operator:
- Fix substitution
- Fix reference in labels
- Adapt labels to pass OBS container checks
- Update to version 1.6.11:
* Bump unit test environment artifacts
* Bump test environment tools in Makefile
* Bump actions
* Refresh auto-generated code (make run)
* Bump controller generator to version 0.19
* Bump golangci/golangci-lint-action
* Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
* Update spec and Dockerfiles to use go1.25
* Bump golang.org/x/net to v0.55.0, includes fixes for:
- bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679
* Update year in header
* Remove labeler workflow
Patchnames: SUSE-SLE-Micro-6.0-750
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
37 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for elemental-operator",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for elemental-operator fixes the following issue\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260277).\n\nChanges for elemental-operator:\n\n- Fix substitution\n- Fix reference in labels\n- Adapt labels to pass OBS container checks\n- Update to version 1.6.11:\n * Bump unit test environment artifacts\n * Bump test environment tools in Makefile\n * Bump actions\n * Refresh auto-generated code (make run)\n * Bump controller generator to version 0.19\n * Bump golangci/golangci-lint-action\n * Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)\n * Update spec and Dockerfiles to use go1.25\n * Bump golang.org/x/net to v0.55.0, includes fixes for:\n - bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679\n * Update year in header\n * Remove labeler workflow\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-750",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22066-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22066-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622066-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22066-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026727.html"
},
{
"category": "self",
"summary": "SUSE Bug 1251679",
"url": "https://bugzilla.suse.com/1251679"
},
{
"category": "self",
"summary": "SUSE Bug 1260277",
"url": "https://bugzilla.suse.com/1260277"
},
{
"category": "self",
"summary": "SUSE Bug 1265921",
"url": "https://bugzilla.suse.com/1265921"
},
{
"category": "self",
"summary": "SUSE Bug 1266789",
"url": "https://bugzilla.suse.com/1266789"
},
{
"category": "self",
"summary": "SUSE Bug 1267168",
"url": "https://bugzilla.suse.com/1267168"
},
{
"category": "self",
"summary": "SUSE Bug 1267197",
"url": "https://bugzilla.suse.com/1267197"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
}
],
"title": "Security update for elemental-operator",
"tracking": {
"current_release_date": "2026-06-10T08:12:23Z",
"generator": {
"date": "2026-06-10T08:12:23Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22066-1",
"initial_release_date": "2026-06-10T08:12:23Z",
"revision_history": [
{
"date": "2026-06-10T08:12:23Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "elemental-register-1.6.11-1.1.aarch64",
"product": {
"name": "elemental-register-1.6.11-1.1.aarch64",
"product_id": "elemental-register-1.6.11-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "elemental-support-1.6.11-1.1.aarch64",
"product": {
"name": "elemental-support-1.6.11-1.1.aarch64",
"product_id": "elemental-support-1.6.11-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "elemental-register-1.6.11-1.1.x86_64",
"product": {
"name": "elemental-register-1.6.11-1.1.x86_64",
"product_id": "elemental-register-1.6.11-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "elemental-support-1.6.11-1.1.x86_64",
"product": {
"name": "elemental-support-1.6.11-1.1.x86_64",
"product_id": "elemental-support-1.6.11-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-register-1.6.11-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64"
},
"product_reference": "elemental-register-1.6.11-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-register-1.6.11-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64"
},
"product_reference": "elemental-register-1.6.11-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-support-1.6.11-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64"
},
"product_reference": "elemental-support-1.6.11-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-support-1.6.11-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
},
"product_reference": "elemental-support-1.6.11-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-register-1.6.11-1.1.x86_64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-support-1.6.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
}
]
}
SUSE-SU-2026:22075-1
Vulnerability from csaf_suse - Published: 2026-06-10 07:45 - Updated: 2026-06-10 07:45Summary
Security update for elemental-operator
Severity
Important
Notes
Title of the patch: Security update for elemental-operator
Description of the patch: This update for elemental-operator fixes the following issue
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260277).
Changes for elemental-operator:
- Changes on top of v1.7.5:
* 41f54076 Fix reference in labels
* 3bdb9321 Adapt labels to pass OBS container checks
- Update to v1.7.5:
* ecfa8d9c Bump unit test environment artifacts
* 03803c72 Bump test environment tools in Makefile
* bc886323 Update auto-generated code (make generate)
* f4d26385 Bump controller generator to version 0.19
* a7fe515d Bump golangci/golangci-lint-action
* b45c5e56 Bump to Dockerfiles and spec to go1.25
* a7d78295 Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
* 2c012c2e Bump golang.org/x/net to v0.55.0, includes fixes for:
- bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679
* 46e7c635 Update headers to 2026
Patchnames: SUSE-SLE-Micro-6.1-571
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
37 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for elemental-operator",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for elemental-operator fixes the following issue\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260277).\n\nChanges for elemental-operator:\n\n- Changes on top of v1.7.5:\n * 41f54076 Fix reference in labels\n * 3bdb9321 Adapt labels to pass OBS container checks\n- Update to v1.7.5:\n * ecfa8d9c Bump unit test environment artifacts\n * 03803c72 Bump test environment tools in Makefile\n * bc886323 Update auto-generated code (make generate)\n * f4d26385 Bump controller generator to version 0.19\n * a7fe515d Bump golangci/golangci-lint-action\n * b45c5e56 Bump to Dockerfiles and spec to go1.25\n * a7d78295 Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)\n * 2c012c2e Bump golang.org/x/net to v0.55.0, includes fixes for:\n - bsc#1266789 bsc#1265921 bsc#1267197 bsc#1267168 bsc#1251679\n * 46e7c635 Update headers to 2026\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-571",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22075-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22075-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622075-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22075-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047285.html"
},
{
"category": "self",
"summary": "SUSE Bug 1251679",
"url": "https://bugzilla.suse.com/1251679"
},
{
"category": "self",
"summary": "SUSE Bug 1260277",
"url": "https://bugzilla.suse.com/1260277"
},
{
"category": "self",
"summary": "SUSE Bug 1265921",
"url": "https://bugzilla.suse.com/1265921"
},
{
"category": "self",
"summary": "SUSE Bug 1266789",
"url": "https://bugzilla.suse.com/1266789"
},
{
"category": "self",
"summary": "SUSE Bug 1267168",
"url": "https://bugzilla.suse.com/1267168"
},
{
"category": "self",
"summary": "SUSE Bug 1267197",
"url": "https://bugzilla.suse.com/1267197"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
}
],
"title": "Security update for elemental-operator",
"tracking": {
"current_release_date": "2026-06-10T07:45:47Z",
"generator": {
"date": "2026-06-10T07:45:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22075-1",
"initial_release_date": "2026-06-10T07:45:47Z",
"revision_history": [
{
"date": "2026-06-10T07:45:47Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"product": {
"name": "elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"product_id": "elemental-register-1.7.5-slfo.1.1_1.1.aarch64"
}
},
{
"category": "product_version",
"name": "elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"product": {
"name": "elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"product_id": "elemental-support-1.7.5-slfo.1.1_1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"product": {
"name": "elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"product_id": "elemental-register-1.7.5-slfo.1.1_1.1.x86_64"
}
},
{
"category": "product_version",
"name": "elemental-support-1.7.5-slfo.1.1_1.1.x86_64",
"product": {
"name": "elemental-support-1.7.5-slfo.1.1_1.1.x86_64",
"product_id": "elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-register-1.7.5-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64"
},
"product_reference": "elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-register-1.7.5-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64"
},
"product_reference": "elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-support-1.7.5-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64"
},
"product_reference": "elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-support-1.7.5-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
},
"product_reference": "elemental-support-1.7.5-slfo.1.1_1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-register-1.7.5-slfo.1.1_1.1.x86_64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-support-1.7.5-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
}
]
}
SUSE-SU-2026:22157-1
Vulnerability from csaf_suse - Published: 2026-06-17 16:31 - Updated: 2026-06-17 16:31Summary
Security update for amazon-ssm-agent
Severity
Important
Notes
Title of the patch: Security update for amazon-ssm-agent
Description of the patch: This update for amazon-ssm-agent fixes the following issues
Update to version 3.3.4624.0:
- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
(bsc#1239342).
- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in
response to a key listing or signing request (bsc#1253611).
- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs
(bsc#1265474).
- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files
can lead to the consumption of corrupted files (bsc#1258095).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege esca (bsc#1266781).
- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during
smart-HTTP clone and fetch operations (bsc#1264952).
- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite
loops, panics or resource consumption (bsc#1267332).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266200).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266200).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266200).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266200).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266200).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).
Changes:
* Bump golang.org/x/crypto from v0.51.0 to v0.52.0
* Bump golang.org/x/net from v0.54.0 to v0.55.0
* Enforce directory boundary in BuildSafePath
* Fix visibility issue with Bottlerocket OS in document output
* Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this
also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
* Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
* Quit if sysprep failed and log its current state
* Remove attached legacy cloudwatch plugin packages
* Upgrade Go version to 1.25.10
* Use BuildSafePath wherever it is applicable
* Add OOM killer protection to systemd service files
* Apply more sanitation to file and registry inventory gatherers
* Bump go-git to v5.17.1
* Deprecate legacy cloudwatch plugin
* Preserve network error details in credential refresher SSM API failures
* Upgrade Go version to 1.25.9
* Add SSM Distributor support for Bottlerocket OS
* Implement flush credentials command in ssm-cli
* Log ec2messages access denied as debug instead of error to reduce log noise
* Make credential refresher refresh cache quickly in case of credential flush
* Make Greengrass component registration resilient with retry
* Add EnforceWorkspaceRootOwnership configuration to support disable
hardening of agent workspace
* Add reboot comment to Windows shutdown command for SSM Agent traceability
* Update privilege access check to verify ownership and permissions
of document state files
* Add read-only version check prior to install and uninstall
in case of occupied package manager locks
* Add ANSI processing for CloudWatch and S3 log
* Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3
to fix CVE-2026-1229
- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
* Disable Go 1.25 container-aware GOMAXPROCS to prevent holding
cgroup file descriptors open
* Upgrade Go version to 1.25.8
* Document CommandWorkerBufferLimit config
* Include package update in Dockerfile
* Reduce CloudWatch event message length threshold
* Upgrade Go version to 1.25.7
* Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
* Update greengrass version
* Update Golang version to 1.24.12
* Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net
from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0
(bsc#1253611, CVE-2025-47913)
* Categorize integration tests by adding new tags to split fast and slow ones
* Fix bug where IP field being empty string and causing UII API failure
* Allow Patch execution to persist across reboots not registered to SSM Agent
* Fix ENV_VAR interpolation to work correctly with parameter store value
* Implement immediate retries for failed reply messages to MGS for RunCommand documents
* Improve ssm-cli get-diagnostics command log output
* Support DomainJoin endpoint for EU sovereign cloud
* Support dualstack S3 endpoint for distributor packages
* Upgrade Go version to 1.24.11
* Add initial IPv6 support with UseDualStackEndpoint configuration option
* Fix CPU utilization issue for instances with thousands of network interfaces
* Add IMDS retry count to account for EC2 droplet refresh
* Fix duplicate uid error logging in MDS module
* Update aws:Domainjoin plugin logging from Log4Net to NLog
* Upgrade Go version to 1.24.7
* Update github.com/go-git/go-git/v5 to 5.15.0
* Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
* Update golang.org/x/net to v0.39.0
* Update golang.org/x/sys to v0.32.0
* Add EU sovereign cloud S3 endpoint for DownloadContent plugin
* Add configurable credential rotation max backoff interval
* Migrate from twinj/uuid to google/uuid library
* Allow newer agent versions to be installed when deploying on Greengrass
* Harden function to remove non-admin run command documents in execution path
* Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
* Enhance testability of custom certificate usage in debug SSM Agent builds
* Decouple serial port from startup and add credential refresher serialport logging
* Add GlobalEnhancedTelemetryEnabled config to README
* Add cloudwatch logs endpoint configuration to optional config for agent
* Update Greengrass component version
* Add file privilege check before processing document state file
* Storing AWS document interpolation ENV_VAR types as environment variables
* Throw explicit error when running local cli as non-priviledged user
* Harden telemetry dynamic config folder permissions
* Add configuration option for HandshakeTimeout
* Improve unit tests
* Add setup for emitting telemetry logs and metrics
* Add initial selection of error logs to emit to telemetry
* Simplify checkstyle and import organization in build scripts
* Update golang.org/x/net from v0.37.0 to v0.38.0
* Agent hibernation reason is logged to EC2 system logs
* Add metrics for the EC2Detector and IMDS EC2 status findings
* Change Linux DomainJoin plugin parameter KeepHostName to accept
both boolean and string
* Upgrade GoLang to version 1.23.8
* Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)
Patchnames: SUSE-SLES-16.0-943
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
4.4 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
77 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for amazon-ssm-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n of document state files\n * Add read-only version check prior to install and uninstall\n in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-943",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22157-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22157-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622157-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22157-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026930.html"
},
{
"category": "self",
"summary": "SUSE Bug 1238702",
"url": "https://bugzilla.suse.com/1238702"
},
{
"category": "self",
"summary": "SUSE Bug 1239342",
"url": "https://bugzilla.suse.com/1239342"
},
{
"category": "self",
"summary": "SUSE Bug 1253611",
"url": "https://bugzilla.suse.com/1253611"
},
{
"category": "self",
"summary": "SUSE Bug 1258095",
"url": "https://bugzilla.suse.com/1258095"
},
{
"category": "self",
"summary": "SUSE Bug 1264952",
"url": "https://bugzilla.suse.com/1264952"
},
{
"category": "self",
"summary": "SUSE Bug 1265474",
"url": "https://bugzilla.suse.com/1265474"
},
{
"category": "self",
"summary": "SUSE Bug 1266200",
"url": "https://bugzilla.suse.com/1266200"
},
{
"category": "self",
"summary": "SUSE Bug 1266781",
"url": "https://bugzilla.suse.com/1266781"
},
{
"category": "self",
"summary": "SUSE Bug 1267332",
"url": "https://bugzilla.suse.com/1267332"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22869 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22869/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22870 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22870/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47913 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47913/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-1229 page",
"url": "https://www.suse.com/security/cve/CVE-2026-1229/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25934 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25934/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44740 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44740/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for amazon-ssm-agent",
"tracking": {
"current_release_date": "2026-06-17T16:31:19Z",
"generator": {
"date": "2026-06-17T16:31:19Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22157-1",
"initial_release_date": "2026-06-17T16:31:19Z",
"revision_history": [
{
"date": "2026-06-17T16:31:19Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"product": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"product_id": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"product": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"product_id": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-22869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22869"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22869",
"url": "https://www.suse.com/security/cve/CVE-2025-22869"
},
{
"category": "external",
"summary": "SUSE Bug 1239322 for CVE-2025-22869",
"url": "https://bugzilla.suse.com/1239322"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2025-22869"
},
{
"cve": "CVE-2025-22870",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22870"
}
],
"notes": [
{
"category": "general",
"text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22870",
"url": "https://www.suse.com/security/cve/CVE-2025-22870"
},
{
"category": "external",
"summary": "SUSE Bug 1238572 for CVE-2025-22870",
"url": "https://bugzilla.suse.com/1238572"
},
{
"category": "external",
"summary": "SUSE Bug 1238611 for CVE-2025-22870",
"url": "https://bugzilla.suse.com/1238611"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "moderate"
}
],
"title": "CVE-2025-22870"
},
{
"cve": "CVE-2025-47913",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47913"
}
],
"notes": [
{
"category": "general",
"text": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47913",
"url": "https://www.suse.com/security/cve/CVE-2025-47913"
},
{
"category": "external",
"summary": "SUSE Bug 1253506 for CVE-2025-47913",
"url": "https://bugzilla.suse.com/1253506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2025-47913"
},
{
"cve": "CVE-2026-1229",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-1229"
}
],
"notes": [
{
"category": "general",
"text": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-1229",
"url": "https://www.suse.com/security/cve/CVE-2026-1229"
},
{
"category": "external",
"summary": "SUSE Bug 1265416 for CVE-2026-1229",
"url": "https://bugzilla.suse.com/1265416"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-1229"
},
{
"cve": "CVE-2026-25934",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25934"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25934",
"url": "https://www.suse.com/security/cve/CVE-2026-25934"
},
{
"category": "external",
"summary": "SUSE Bug 1258093 for CVE-2026-25934",
"url": "https://bugzilla.suse.com/1258093"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "moderate"
}
],
"title": "CVE-2026-25934"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41506"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41506",
"url": "https://www.suse.com/security/cve/CVE-2026-41506"
},
{
"category": "external",
"summary": "SUSE Bug 1264854 for CVE-2026-41506",
"url": "https://bugzilla.suse.com/1264854"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "moderate"
}
],
"title": "CVE-2026-41506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-44740",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44740"
}
],
"notes": [
{
"category": "general",
"text": "Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44740",
"url": "https://www.suse.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "SUSE Bug 1267264 for CVE-2026-44740",
"url": "https://bugzilla.suse.com/1267264"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-44740"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22159-1
Vulnerability from csaf_suse - Published: 2026-06-18 14:30 - Updated: 2026-06-18 14:30Summary
Security update for distribution
Severity
Important
Notes
Title of the patch: Security update for distribution
Description of the patch: This update for distribution fixes the following issues
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265788).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266629).
- CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266049).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266049).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266049).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266049).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266049).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).
Changes:
* Bounds-check the file basename in PurgeUploads Walk callback
* Add S3 Express One Zone support to the S3 storage driver
* Fix tag list endpoint in proxy mode
* Clamp oversized `n` query parameter in proxy mode instead of
returning 400
* See the full changelog below for the full list of changes.
* internal/client/auth/challenge: cleanups and minor refactor
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
from 0.18.0 to 0.19.0 in the go_modules group across 1
directory
* build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl
ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules
group across 1 directory
* build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
* chore(build): Bump go version to latest
* refactor: use slices.Backward to simplify the code
* fix(proxy): fix tag list endpoint in proxy mode
* Update docker-compose structure in deploying.md
* build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
* build(deps): bump actions/upload-pages-artifact from 4.0.0 to
5.0.0
* build(deps): bump docker/login-action from 4.0.0 to 4.1.0
* build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
* fix(proxy): clamp oversized n query param instead of
* feat(s3): add express zone one support to S3 driver
* fix(storage): bounds-check the file basename in PurgeUploads
Walk callback
* chore(release): prepare for v3.1.1 release
Patchnames: SUSE-SLES-16.0-949
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
57 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for distribution",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for distribution fixes the following issues\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265788).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266629).\n- CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266049).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266049).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266049).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266049).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266049).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).\n\nChanges:\n\n * Bounds-check the file basename in PurgeUploads Walk callback\n * Add S3 Express One Zone support to the S3 storage driver\n * Fix tag list endpoint in proxy mode\n * Clamp oversized `n` query parameter in proxy mode instead of\n returning 400\n * See the full changelog below for the full list of changes.\n * internal/client/auth/challenge: cleanups and minor refactor\n * build(deps): bump\n go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n from 0.18.0 to 0.19.0 in the go_modules group across 1\n directory\n * build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl\n ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules\n group across 1 directory\n * build(deps): bump github/codeql-action from 4.34.1 to 4.35.1\n * chore(build): Bump go version to latest\n * refactor: use slices.Backward to simplify the code\n * fix(proxy): fix tag list endpoint in proxy mode\n * Update docker-compose structure in deploying.md\n * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1\n * build(deps): bump actions/upload-pages-artifact from 4.0.0 to\n 5.0.0\n * build(deps): bump docker/login-action from 4.0.0 to 4.1.0\n * build(deps): bump docker/bake-action from 7.0.0 to 7.1.0\n * fix(proxy): clamp oversized n query param instead of\n * feat(s3): add express zone one support to S3 driver\n * fix(storage): bounds-check the file basename in PurgeUploads\n Walk callback\n * chore(release): prepare for v3.1.1 release\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-949",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22159-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22159-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622159-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22159-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026928.html"
},
{
"category": "self",
"summary": "SUSE Bug 1265429",
"url": "https://bugzilla.suse.com/1265429"
},
{
"category": "self",
"summary": "SUSE Bug 1265788",
"url": "https://bugzilla.suse.com/1265788"
},
{
"category": "self",
"summary": "SUSE Bug 1266049",
"url": "https://bugzilla.suse.com/1266049"
},
{
"category": "self",
"summary": "SUSE Bug 1266629",
"url": "https://bugzilla.suse.com/1266629"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41888 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41888/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for distribution",
"tracking": {
"current_release_date": "2026-06-18T14:30:18Z",
"generator": {
"date": "2026-06-18T14:30:18Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22159-1",
"initial_release_date": "2026-06-18T14:30:18Z",
"revision_history": [
{
"date": "2026-06-18T14:30:18Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.aarch64",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.aarch64",
"product_id": "distribution-registry-3.1.1-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"product_id": "distribution-registry-3.1.1-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.s390x",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.s390x",
"product_id": "distribution-registry-3.1.1-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.x86_64",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.x86_64",
"product_id": "distribution-registry-3.1.1-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41888",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41888"
}
],
"notes": [
{
"category": "general",
"text": "Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/\u003cname\u003e/manifests/\u003ctag\u003e endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41888",
"url": "https://www.suse.com/security/cve/CVE-2026-41888"
},
{
"category": "external",
"summary": "SUSE Bug 1265422 for CVE-2026-41888",
"url": "https://bugzilla.suse.com/1265422"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "moderate"
}
],
"title": "CVE-2026-41888"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22193-1
Vulnerability from csaf_suse - Published: 2026-06-20 06:52 - Updated: 2026-06-20 06:52Summary
Security update for mcphost
Severity
Important
Notes
Title of the patch: Security update for mcphost
Description of the patch: This update for mcphost fixes the following issues
- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues
when parsing HTML files (bsc#1267109).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265730).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266572).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266145).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266145).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).
Patchnames: SUSE-SLES-16.0-985
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
69 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mcphost",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mcphost fixes the following issues\n\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n when parsing HTML files (bsc#1267109).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265730).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266572).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266145).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266145).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-985",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22193-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22193-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622193-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22193-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047515.html"
},
{
"category": "self",
"summary": "SUSE Bug 1265730",
"url": "https://bugzilla.suse.com/1265730"
},
{
"category": "self",
"summary": "SUSE Bug 1266145",
"url": "https://bugzilla.suse.com/1266145"
},
{
"category": "self",
"summary": "SUSE Bug 1266572",
"url": "https://bugzilla.suse.com/1266572"
},
{
"category": "self",
"summary": "SUSE Bug 1267109",
"url": "https://bugzilla.suse.com/1267109"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for mcphost",
"tracking": {
"current_release_date": "2026-06-20T06:52:25Z",
"generator": {
"date": "2026-06-20T06:52:25Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22193-1",
"initial_release_date": "2026-06-20T06:52:25Z",
"revision_history": [
{
"date": "2026-06-20T06:52:25Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product_id": "mcphost-0.34.0-160000.2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product_id": "mcphost-0.34.0-160000.2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product": {
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product_id": "mcphost-0.34.0-160000.2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product_id": "mcphost-0.34.0-160000.2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le"
},
"product_reference": "mcphost-0.34.0-160000.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x"
},
"product_reference": "mcphost-0.34.0-160000.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le"
},
"product_reference": "mcphost-0.34.0-160000.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x"
},
"product_reference": "mcphost-0.34.0-160000.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22226-1
Vulnerability from csaf_suse - Published: 2026-06-20 06:52 - Updated: 2026-06-20 06:52Summary
Security update for mcphost
Severity
Important
Notes
Title of the patch: Security update for mcphost
Description of the patch: This update for mcphost fixes the following issues
- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues
when parsing HTML files (bsc#1267109).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265730).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266572).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266145).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266145).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).
Patchnames: SUSE-SL-Micro-6.2-985
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
69 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mcphost",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mcphost fixes the following issues\n\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n when parsing HTML files (bsc#1267109).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265730).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266572).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266145).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266145).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-985",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22226-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22226-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622226-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22226-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047482.html"
},
{
"category": "self",
"summary": "SUSE Bug 1265730",
"url": "https://bugzilla.suse.com/1265730"
},
{
"category": "self",
"summary": "SUSE Bug 1266145",
"url": "https://bugzilla.suse.com/1266145"
},
{
"category": "self",
"summary": "SUSE Bug 1266572",
"url": "https://bugzilla.suse.com/1266572"
},
{
"category": "self",
"summary": "SUSE Bug 1267109",
"url": "https://bugzilla.suse.com/1267109"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for mcphost",
"tracking": {
"current_release_date": "2026-06-20T06:52:25Z",
"generator": {
"date": "2026-06-20T06:52:25Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22226-1",
"initial_release_date": "2026-06-20T06:52:25Z",
"revision_history": [
{
"date": "2026-06-20T06:52:25Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product_id": "mcphost-0.34.0-160000.2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product_id": "mcphost-0.34.0-160000.2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product": {
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product_id": "mcphost-0.34.0-160000.2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product_id": "mcphost-0.34.0-160000.2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le"
},
"product_reference": "mcphost-0.34.0-160000.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x"
},
"product_reference": "mcphost-0.34.0-160000.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22233-1
Vulnerability from csaf_suse - Published: 2026-06-21 00:45 - Updated: 2026-06-21 00:45Summary
Security update for helm
Severity
Important
Notes
Title of the patch: Security update for helm
Description of the patch: This update for helm fixes the following issue
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266598).
Changes for helm:
- Update to version 3.21.1:
* Fixed nil pointer panic that could happen with helm template in
ClientOnly flows. Now correctly returns a template error #31920
* Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026
#32152
* Bumped Go from 1.25 to 1.26 #32168
* Dependency version updates
- chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
- chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
- chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
- chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
- chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
- chore(deps): bump github.com/distribution/distribution/v3
- chore(deps): bump github.com/containerd/containerd from
1.7.30 to 1.7.32
- chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0
to 3.5.0
- chore(deps): bump github.com/mattn/go-shellwords from 1.0.12
to 1.0.13
- chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
- chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0
- chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0
Patchnames: SUSE-SL-Micro-6.2-1006
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:helm-bash-completion-3.21.1-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for helm",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for helm fixes the following issue\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266598).\n\nChanges for helm:\n\n- Update to version 3.21.1:\n\n * Fixed nil pointer panic that could happen with helm template in\n ClientOnly flows. Now correctly returns a template error #31920\n * Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026\n #32152\n * Bumped Go from 1.25 to 1.26 #32168\n * Dependency version updates\n - chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1\n - chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0\n - chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0\n - chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0\n - chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3\n - chore(deps): bump github.com/distribution/distribution/v3\n - chore(deps): bump github.com/containerd/containerd from\n 1.7.30 to 1.7.32\n - chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0\n to 3.5.0\n - chore(deps): bump github.com/mattn/go-shellwords from 1.0.12\n to 1.0.13\n - chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0\n - chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0\n - chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-1006",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22233-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22233-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622233-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22233-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047475.html"
},
{
"category": "self",
"summary": "SUSE Bug 1266598",
"url": "https://bugzilla.suse.com/1266598"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
}
],
"title": "Security update for helm",
"tracking": {
"current_release_date": "2026-06-21T00:45:47Z",
"generator": {
"date": "2026-06-21T00:45:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22233-1",
"initial_release_date": "2026-06-21T00:45:47Z",
"revision_history": [
{
"date": "2026-06-21T00:45:47Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "helm-3.21.1-160000.1.1.aarch64",
"product": {
"name": "helm-3.21.1-160000.1.1.aarch64",
"product_id": "helm-3.21.1-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"product": {
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"product_id": "helm-bash-completion-3.21.1-160000.1.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "helm-3.21.1-160000.1.1.ppc64le",
"product": {
"name": "helm-3.21.1-160000.1.1.ppc64le",
"product_id": "helm-3.21.1-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "helm-3.21.1-160000.1.1.x86_64",
"product": {
"name": "helm-3.21.1-160000.1.1.x86_64",
"product_id": "helm-3.21.1-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.aarch64"
},
"product_reference": "helm-3.21.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.ppc64le"
},
"product_reference": "helm-3.21.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-3.21.1-160000.1.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.x86_64"
},
"product_reference": "helm-3.21.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "helm-bash-completion-3.21.1-160000.1.1.noarch as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:helm-bash-completion-3.21.1-160000.1.1.noarch"
},
"product_reference": "helm-bash-completion-3.21.1-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.aarch64",
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.ppc64le",
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.x86_64",
"SUSE Linux Micro 6.2:helm-bash-completion-3.21.1-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.aarch64",
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.ppc64le",
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.x86_64",
"SUSE Linux Micro 6.2:helm-bash-completion-3.21.1-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.aarch64",
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.ppc64le",
"SUSE Linux Micro 6.2:helm-3.21.1-160000.1.1.x86_64",
"SUSE Linux Micro 6.2:helm-bash-completion-3.21.1-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-21T00:45:47Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…