Vulnerability-Lookup

OPENSUSE-SU-2026:11871-1

Vulnerability from csaf_opensuse - Published: 2026-09-24 00:00 - Updated: 2026-09-25 08:57

Summary

cosign-3.1.3-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: cosign-3.1.3-1.1 on GA media

Description of the patch: These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11871

CVE-2026-56852

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-56855

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-56852

Threats

Impact important

CVE-2026-56864

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-56852

Threats

Impact moderate

CVE-2026-84304

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-56852

Threats

Impact important

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-56852/	self
https://www.suse.com/security/cve/CVE-2026-56855/	self
https://www.suse.com/security/cve/CVE-2026-56864/	self
https://www.suse.com/security/cve/CVE-2026-84304/	self
https://www.suse.com/security/cve/CVE-2026-56852	external
https://bugzilla.suse.com/1271661	external
https://bugzilla.suse.com/1280553	external
https://www.suse.com/security/cve/CVE-2026-56855	external
https://bugzilla.suse.com/1278446	external
https://bugzilla.suse.com/1280553	external
https://www.suse.com/security/cve/CVE-2026-56864	external
https://bugzilla.suse.com/1275025	external
https://www.suse.com/security/cve/CVE-2026-84304	external
https://bugzilla.suse.com/1278271	external
https://bugzilla.suse.com/1280553	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cosign-3.1.3-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11871",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11871-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56852 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56852/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56855 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56855/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56864 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56864/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84304 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84304/"
      }
    ],
    "title": "cosign-3.1.3-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-25T08:57:13Z",
      "generator": {
        "date": "2026-09-24T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11871-1",
      "initial_release_date": "2026-09-24T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-24T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-25T08:57:13Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-0:3.1.3-1.1.aarch64",
                "product": {
                  "name": "cosign-0:3.1.3-1.1.aarch64",
                  "product_id": "cosign-0:3.1.3-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign@3.1.3-1.1?arch=aarch64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-0:3.1.3-1.1.aarch64",
                "product": {
                  "name": "cosign-bash-completion-0:3.1.3-1.1.aarch64",
                  "product_id": "cosign-bash-completion-0:3.1.3-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-bash-completion@3.1.3-1.1?arch=aarch64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-0:3.1.3-1.1.aarch64",
                "product": {
                  "name": "cosign-fish-completion-0:3.1.3-1.1.aarch64",
                  "product_id": "cosign-fish-completion-0:3.1.3-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-fish-completion@3.1.3-1.1?arch=aarch64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-0:3.1.3-1.1.aarch64",
                "product": {
                  "name": "cosign-zsh-completion-0:3.1.3-1.1.aarch64",
                  "product_id": "cosign-zsh-completion-0:3.1.3-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-zsh-completion@3.1.3-1.1?arch=aarch64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-0:3.1.3-1.1.ppc64le",
                "product": {
                  "name": "cosign-0:3.1.3-1.1.ppc64le",
                  "product_id": "cosign-0:3.1.3-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign@3.1.3-1.1?arch=ppc64le\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-0:3.1.3-1.1.ppc64le",
                "product": {
                  "name": "cosign-bash-completion-0:3.1.3-1.1.ppc64le",
                  "product_id": "cosign-bash-completion-0:3.1.3-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-bash-completion@3.1.3-1.1?arch=ppc64le\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-0:3.1.3-1.1.ppc64le",
                "product": {
                  "name": "cosign-fish-completion-0:3.1.3-1.1.ppc64le",
                  "product_id": "cosign-fish-completion-0:3.1.3-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-fish-completion@3.1.3-1.1?arch=ppc64le\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
                "product": {
                  "name": "cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
                  "product_id": "cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-zsh-completion@3.1.3-1.1?arch=ppc64le\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-0:3.1.3-1.1.s390x",
                "product": {
                  "name": "cosign-0:3.1.3-1.1.s390x",
                  "product_id": "cosign-0:3.1.3-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign@3.1.3-1.1?arch=s390x\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-0:3.1.3-1.1.s390x",
                "product": {
                  "name": "cosign-bash-completion-0:3.1.3-1.1.s390x",
                  "product_id": "cosign-bash-completion-0:3.1.3-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-bash-completion@3.1.3-1.1?arch=s390x\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-0:3.1.3-1.1.s390x",
                "product": {
                  "name": "cosign-fish-completion-0:3.1.3-1.1.s390x",
                  "product_id": "cosign-fish-completion-0:3.1.3-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-fish-completion@3.1.3-1.1?arch=s390x\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-0:3.1.3-1.1.s390x",
                "product": {
                  "name": "cosign-zsh-completion-0:3.1.3-1.1.s390x",
                  "product_id": "cosign-zsh-completion-0:3.1.3-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-zsh-completion@3.1.3-1.1?arch=s390x\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cosign-0:3.1.3-1.1.x86_64",
                "product": {
                  "name": "cosign-0:3.1.3-1.1.x86_64",
                  "product_id": "cosign-0:3.1.3-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign@3.1.3-1.1?arch=x86_64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-bash-completion-0:3.1.3-1.1.x86_64",
                "product": {
                  "name": "cosign-bash-completion-0:3.1.3-1.1.x86_64",
                  "product_id": "cosign-bash-completion-0:3.1.3-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-bash-completion@3.1.3-1.1?arch=x86_64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-fish-completion-0:3.1.3-1.1.x86_64",
                "product": {
                  "name": "cosign-fish-completion-0:3.1.3-1.1.x86_64",
                  "product_id": "cosign-fish-completion-0:3.1.3-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-fish-completion@3.1.3-1.1?arch=x86_64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cosign-zsh-completion-0:3.1.3-1.1.x86_64",
                "product": {
                  "name": "cosign-zsh-completion-0:3.1.3-1.1.x86_64",
                  "product_id": "cosign-zsh-completion-0:3.1.3-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:sigstore:cosign:3.1.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/cosign-zsh-completion@3.1.3-1.1?arch=x86_64\u0026upstream=cosign-0:3.1.3-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-0:3.1.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64"
        },
        "product_reference": "cosign-0:3.1.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-0:3.1.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le"
        },
        "product_reference": "cosign-0:3.1.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-0:3.1.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x"
        },
        "product_reference": "cosign-0:3.1.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-0:3.1.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64"
        },
        "product_reference": "cosign-0:3.1.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-0:3.1.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64"
        },
        "product_reference": "cosign-bash-completion-0:3.1.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-0:3.1.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le"
        },
        "product_reference": "cosign-bash-completion-0:3.1.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-0:3.1.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x"
        },
        "product_reference": "cosign-bash-completion-0:3.1.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-bash-completion-0:3.1.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64"
        },
        "product_reference": "cosign-bash-completion-0:3.1.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-0:3.1.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64"
        },
        "product_reference": "cosign-fish-completion-0:3.1.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-0:3.1.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le"
        },
        "product_reference": "cosign-fish-completion-0:3.1.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-0:3.1.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x"
        },
        "product_reference": "cosign-fish-completion-0:3.1.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-fish-completion-0:3.1.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64"
        },
        "product_reference": "cosign-fish-completion-0:3.1.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-0:3.1.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64"
        },
        "product_reference": "cosign-zsh-completion-0:3.1.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-0:3.1.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le"
        },
        "product_reference": "cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-0:3.1.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x"
        },
        "product_reference": "cosign-zsh-completion-0:3.1.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cosign-zsh-completion-0:3.1.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
        },
        "product_reference": "cosign-zsh-completion-0:3.1.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56852",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56852"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56852",
          "url": "https://www.suse.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271661 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1271661"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56852"
    },
    {
      "cve": "CVE-2026-56855",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56855"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56855",
          "url": "https://www.suse.com/security/cve/CVE-2026-56855"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-56855",
          "url": "https://bugzilla.suse.com/1278446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56855",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56855"
    },
    {
      "cve": "CVE-2026-56864",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56864"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56864",
          "url": "https://www.suse.com/security/cve/CVE-2026-56864"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275025 for CVE-2026-56864",
          "url": "https://bugzilla.suse.com/1275025"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56864"
    },
    {
      "cve": "CVE-2026-84304",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84304"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
          "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84304",
          "url": "https://www.suse.com/security/cve/CVE-2026-84304"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278271 for CVE-2026-84304",
          "url": "https://bugzilla.suse.com/1278271"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-84304",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-bash-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-fish-completion-0:3.1.3-1.1.x86_64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.aarch64",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.ppc64le",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.s390x",
            "openSUSE Tumbleweed:cosign-zsh-completion-0:3.1.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-84304"
    }
  ]
}

CVE-2026-56852 (GCVE-0-2026-56852)

Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57

Title

Infinite loop on invalid input in golang.org/x/text

Summary

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 13:26 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

3 references

URL	Tags
https://go.dev/issue/80142
https://go.dev/cl/794100
https://pkg.go.dev/vuln/GO-2026-5970

Impacted products

1 product

Vendor	Product	Version
golang.org/x/text	golang.org/x/text/unicode/norm	Affected: 0 , < 0.39.0 (semver)

Credits

Viky Choi ("vikychoi" on GitHub)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:26:14.918983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:26:20.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/text/unicode/norm",
          "product": "golang.org/x/text/unicode/norm",
          "programRoutines": [
            {
              "name": "nextComposed"
            },
            {
              "name": "Form.Append"
            },
            {
              "name": "Form.AppendString"
            },
            {
              "name": "Form.Bytes"
            },
            {
              "name": "Form.FirstBoundary"
            },
            {
              "name": "Form.FirstBoundaryInString"
            },
            {
              "name": "Form.IsNormal"
            },
            {
              "name": "Form.IsNormalString"
            },
            {
              "name": "Form.LastBoundary"
            },
            {
              "name": "Form.NextBoundary"
            },
            {
              "name": "Form.NextBoundaryInString"
            },
            {
              "name": "Form.Properties"
            },
            {
              "name": "Form.PropertiesString"
            },
            {
              "name": "Form.QuickSpan"
            },
            {
              "name": "Form.QuickSpanString"
            },
            {
              "name": "Form.Span"
            },
            {
              "name": "Form.SpanString"
            },
            {
              "name": "Form.String"
            },
            {
              "name": "Form.Transform"
            },
            {
              "name": "Iter.Init"
            },
            {
              "name": "Iter.InitString"
            },
            {
              "name": "Iter.Next"
            },
            {
              "name": "Iter.Seek"
            },
            {
              "name": "normReader.Read"
            },
            {
              "name": "normWriter.Write"
            }
          ],
          "vendor": "golang.org/x/text",
          "versions": [
            {
              "lessThan": "0.39.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Viky Choi (\"vikychoi\" on GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T22:57:54.703Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80142"
        },
        {
          "url": "https://go.dev/cl/794100"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "title": "Infinite loop on invalid input in golang.org/x/text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56852",
    "datePublished": "2026-07-21T19:18:59.951Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-10T22:57:54.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56855 (GCVE-0-2026-56855)

Vulnerability from cvelistv5 – Published: 2026-09-02 19:37 – Updated: 2026-09-03 14:14

Title

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Summary

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 14:13 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/81317
https://go.dev/cl/826524
https://groups.google.com/g/golang-announce/c/1y3…
https://pkg.go.dev/vuln/GO-2026-6355

Impacted products

1 product

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.56.0 (semver)

Credits

Will Mortensen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T14:13:54.397574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T14:14:40.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "channel.handlePacket"
            },
            {
              "name": "Dial"
            },
            {
              "name": "NewClientConn"
            },
            {
              "name": "NewControlClientConn"
            },
            {
              "name": "NewServerConn"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.56.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Will Mortensen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T19:37:05.807Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/81317"
        },
        {
          "url": "https://go.dev/cl/826524"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/1y3fb2np35U"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6355"
        }
      ],
      "title": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56855",
    "datePublished": "2026-09-02T19:37:05.807Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-09-03T14:14:40.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56864 (GCVE-0-2026-56864)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16

Title

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Summary

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:16 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/issue/80745
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/815000
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6180

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb	Affected: 0 , < 0.40.0 (semver)

Credits

mundur

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56864",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:16:37.911009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:16:42.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb",
          "product": "golang.org/x/mod/sumdb",
          "programRoutines": [
            {
              "name": "Client.Lookup"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "mundur"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.605Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80745"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/815000"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6180"
        }
      ],
      "title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56864",
    "datePublished": "2026-08-13T21:58:53.605Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T16:16:42.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84304 (GCVE-0-2026-84304)

Vulnerability from cvelistv5 – Published: 2026-09-01 18:19 – Updated: 2026-09-01 19:24

Title

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 19:23 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/grpc/grpc-go/security/advisori…	x_refsource_CONFIRM
https://github.com/grpc/grpc-go/pull/9331	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9333	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/7354d9c8de…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/8cfeca0e1e…	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.83.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-go	Affected: < 1.83.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84304",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T19:23:26.130673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T19:24:36.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.83.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T18:19:10.100Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9331",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9331"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9333",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9333"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.83.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.1"
        }
      ],
      "source": {
        "advisory": "GHSA-vp52-pcj8-j9qc",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84304",
    "datePublished": "2026-09-01T18:19:10.100Z",
    "dateReserved": "2026-09-01T16:17:43.078Z",
    "dateUpdated": "2026-09-01T19:24:36.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11871-1

CVE-2026-56852 (GCVE-0-2026-56852)

CVE-2026-56855 (GCVE-0-2026-56855)

CVE-2026-56864 (GCVE-0-2026-56864)

CVE-2026-84304 (GCVE-0-2026-84304)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour