OPENSUSE-SU-2026:12164-1

Vulnerability from csaf_opensuse - Published: 2026-10-17 00:00 - Updated: 2026-10-18 10:27
Summary
hugo-0.168.0-2.1 on GA media
Severity
Moderate
Notes
Title of the patch: hugo-0.168.0-2.1 on GA media
Description of the patch: These are all security issues fixed in the hugo-0.168.0-2.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12164
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-100347
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-100348
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 12 products, the same list as for CVE-2026-100347
Threats
Impact important
CVE-2026-100349
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 12 products, the same list as for CVE-2026-100347
Threats
Impact important
CVE-2026-100350
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 12 products, the same list as for CVE-2026-100347
Threats
Impact moderate
CVE-2026-100351
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 12 products, the same list as for CVE-2026-100347
Threats
Impact important
CVE-2026-100352
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 12 products, the same list as for CVE-2026-100347
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "hugo-0.168.0-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the hugo-0.168.0-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12164",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12164-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-100347 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-100347/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-100348 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-100348/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-100349 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-100349/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-100350 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-100350/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-100351 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-100351/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-100352 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-100352/"
      }
    ],
    "title": "hugo-0.168.0-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-18T10:27:41Z",
      "generator": {
        "date": "2026-10-17T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12164-1",
      "initial_release_date": "2026-10-17T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-17T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-18T10:27:41Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.168.0-2.1.aarch64",
                "product": {
                  "name": "hugo-0:0.168.0-2.1.aarch64",
                  "product_id": "hugo-0:0.168.0-2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo@0.168.0-2.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-bash-completion-0:0.168.0-2.1.aarch64",
                "product": {
                  "name": "hugo-bash-completion-0:0.168.0-2.1.aarch64",
                  "product_id": "hugo-bash-completion-0:0.168.0-2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-bash-completion@0.168.0-2.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-zsh-completion-0:0.168.0-2.1.aarch64",
                "product": {
                  "name": "hugo-zsh-completion-0:0.168.0-2.1.aarch64",
                  "product_id": "hugo-zsh-completion-0:0.168.0-2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-zsh-completion@0.168.0-2.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.168.0-2.1.ppc64le",
                "product": {
                  "name": "hugo-0:0.168.0-2.1.ppc64le",
                  "product_id": "hugo-0:0.168.0-2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo@0.168.0-2.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-bash-completion-0:0.168.0-2.1.ppc64le",
                "product": {
                  "name": "hugo-bash-completion-0:0.168.0-2.1.ppc64le",
                  "product_id": "hugo-bash-completion-0:0.168.0-2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-bash-completion@0.168.0-2.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
                "product": {
                  "name": "hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
                  "product_id": "hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-zsh-completion@0.168.0-2.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.168.0-2.1.s390x",
                "product": {
                  "name": "hugo-0:0.168.0-2.1.s390x",
                  "product_id": "hugo-0:0.168.0-2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo@0.168.0-2.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-bash-completion-0:0.168.0-2.1.s390x",
                "product": {
                  "name": "hugo-bash-completion-0:0.168.0-2.1.s390x",
                  "product_id": "hugo-bash-completion-0:0.168.0-2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-bash-completion@0.168.0-2.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-zsh-completion-0:0.168.0-2.1.s390x",
                "product": {
                  "name": "hugo-zsh-completion-0:0.168.0-2.1.s390x",
                  "product_id": "hugo-zsh-completion-0:0.168.0-2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-zsh-completion@0.168.0-2.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hugo-0:0.168.0-2.1.x86_64",
                "product": {
                  "name": "hugo-0:0.168.0-2.1.x86_64",
                  "product_id": "hugo-0:0.168.0-2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo@0.168.0-2.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-bash-completion-0:0.168.0-2.1.x86_64",
                "product": {
                  "name": "hugo-bash-completion-0:0.168.0-2.1.x86_64",
                  "product_id": "hugo-bash-completion-0:0.168.0-2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-bash-completion@0.168.0-2.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hugo-zsh-completion-0:0.168.0-2.1.x86_64",
                "product": {
                  "name": "hugo-zsh-completion-0:0.168.0-2.1.x86_64",
                  "product_id": "hugo-zsh-completion-0:0.168.0-2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/hugo-zsh-completion@0.168.0-2.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.168.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64"
        },
        "product_reference": "hugo-0:0.168.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.168.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le"
        },
        "product_reference": "hugo-0:0.168.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.168.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x"
        },
        "product_reference": "hugo-0:0.168.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-0:0.168.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64"
        },
        "product_reference": "hugo-0:0.168.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-bash-completion-0:0.168.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64"
        },
        "product_reference": "hugo-bash-completion-0:0.168.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-bash-completion-0:0.168.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le"
        },
        "product_reference": "hugo-bash-completion-0:0.168.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-bash-completion-0:0.168.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x"
        },
        "product_reference": "hugo-bash-completion-0:0.168.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-bash-completion-0:0.168.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64"
        },
        "product_reference": "hugo-bash-completion-0:0.168.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-zsh-completion-0:0.168.0-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64"
        },
        "product_reference": "hugo-zsh-completion-0:0.168.0-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-zsh-completion-0:0.168.0-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le"
        },
        "product_reference": "hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-zsh-completion-0:0.168.0-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x"
        },
        "product_reference": "hugo-zsh-completion-0:0.168.0-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hugo-zsh-completion-0:0.168.0-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        },
        "product_reference": "hugo-zsh-completion-0:0.168.0-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-100347",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-100347"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-100347",
          "url": "https://www.suse.com/security/cve/CVE-2026-100347"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285785 for CVE-2026-100347",
          "url": "https://bugzilla.suse.com/1285785"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-100347"
    },
    {
      "cve": "CVE-2026-100348",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-100348"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-100348",
          "url": "https://www.suse.com/security/cve/CVE-2026-100348"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285789 for CVE-2026-100348",
          "url": "https://bugzilla.suse.com/1285789"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-100348"
    },
    {
      "cve": "CVE-2026-100349",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-100349"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-100349",
          "url": "https://www.suse.com/security/cve/CVE-2026-100349"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285793 for CVE-2026-100349",
          "url": "https://bugzilla.suse.com/1285793"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-100349"
    },
    {
      "cve": "CVE-2026-100350",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-100350"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-100350",
          "url": "https://www.suse.com/security/cve/CVE-2026-100350"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285797 for CVE-2026-100350",
          "url": "https://bugzilla.suse.com/1285797"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-100350"
    },
    {
      "cve": "CVE-2026-100351",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-100351"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-100351",
          "url": "https://www.suse.com/security/cve/CVE-2026-100351"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285801 for CVE-2026-100351",
          "url": "https://bugzilla.suse.com/1285801"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-100351"
    },
    {
      "cve": "CVE-2026-100352",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-100352"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi\u0027s existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
          "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-100352",
          "url": "https://www.suse.com/security/cve/CVE-2026-100352"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1285807 for CVE-2026-100352",
          "url": "https://bugzilla.suse.com/1285807"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-bash-completion-0:0.168.0-2.1.x86_64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.aarch64",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.ppc64le",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.s390x",
            "openSUSE Tumbleweed:hugo-zsh-completion-0:0.168.0-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-100352"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.