Vulnerability-Lookup

OPENSUSE-SU-2026:12260-1

Vulnerability from csaf_opensuse - Published: 2026-10-24 00:00 - Updated: 2026-10-26 10:35

Summary

buildpacks-cli-0.40.10-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: buildpacks-cli-0.40.10-1.1 on GA media

Description of the patch: These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12260

CVE-2026-111943

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-17106

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-111943

Threats

Impact important

CVE-2026-61801

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-111943

Threats

Impact moderate

CVE-2026-78659

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-111943

Threats

Impact important

CVE-2026-78662

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 16 products, the same list as for CVE-2026-111943

Threats

Impact important

References

19 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-111943/	self
https://www.suse.com/security/cve/CVE-2026-17106/	self
https://www.suse.com/security/cve/CVE-2026-61801/	self
https://www.suse.com/security/cve/CVE-2026-78659/	self
https://www.suse.com/security/cve/CVE-2026-78662/	self
https://www.suse.com/security/cve/CVE-2026-111943	external
https://bugzilla.suse.com/1286317	external
https://www.suse.com/security/cve/CVE-2026-17106	external
https://bugzilla.suse.com/1275243	external
https://www.suse.com/security/cve/CVE-2026-61801	external
https://bugzilla.suse.com/1284848	external
https://www.suse.com/security/cve/CVE-2026-78659	external
https://bugzilla.suse.com/1284768	external
https://bugzilla.suse.com/1286134	external
https://www.suse.com/security/cve/CVE-2026-78662	external
https://bugzilla.suse.com/1278446	external
https://bugzilla.suse.com/1280553	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "buildpacks-cli-0.40.10-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12260",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12260-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-111943 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-111943/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-17106 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-17106/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-61801 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-61801/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-78659 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-78659/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-78662 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-78662/"
      }
    ],
    "title": "buildpacks-cli-0.40.10-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-26T10:35:09Z",
      "generator": {
        "date": "2026-10-24T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12260-1",
      "initial_release_date": "2026-10-24T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-24T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-26T10:35:09Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "buildpacks-cli-0:0.40.10-1.1.aarch64",
                "product": {
                  "name": "buildpacks-cli-0:0.40.10-1.1.aarch64",
                  "product_id": "buildpacks-cli-0:0.40.10-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli@0.40.10-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
                "product": {
                  "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
                  "product_id": "buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-bash-completion@0.40.10-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
                "product": {
                  "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
                  "product_id": "buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-fish-completion@0.40.10-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
                "product": {
                  "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
                  "product_id": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-zsh-completion@0.40.10-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "buildpacks-cli-0:0.40.10-1.1.ppc64le",
                "product": {
                  "name": "buildpacks-cli-0:0.40.10-1.1.ppc64le",
                  "product_id": "buildpacks-cli-0:0.40.10-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli@0.40.10-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
                "product": {
                  "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
                  "product_id": "buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-bash-completion@0.40.10-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
                "product": {
                  "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
                  "product_id": "buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-fish-completion@0.40.10-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
                "product": {
                  "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
                  "product_id": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-zsh-completion@0.40.10-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "buildpacks-cli-0:0.40.10-1.1.s390x",
                "product": {
                  "name": "buildpacks-cli-0:0.40.10-1.1.s390x",
                  "product_id": "buildpacks-cli-0:0.40.10-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli@0.40.10-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
                "product": {
                  "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
                  "product_id": "buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-bash-completion@0.40.10-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
                "product": {
                  "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
                  "product_id": "buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-fish-completion@0.40.10-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
                "product": {
                  "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
                  "product_id": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-zsh-completion@0.40.10-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "buildpacks-cli-0:0.40.10-1.1.x86_64",
                "product": {
                  "name": "buildpacks-cli-0:0.40.10-1.1.x86_64",
                  "product_id": "buildpacks-cli-0:0.40.10-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli@0.40.10-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
                "product": {
                  "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
                  "product_id": "buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-bash-completion@0.40.10-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
                "product": {
                  "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
                  "product_id": "buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-fish-completion@0.40.10-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64",
                "product": {
                  "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64",
                  "product_id": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/buildpacks-cli-zsh-completion@0.40.10-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-0:0.40.10-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64"
        },
        "product_reference": "buildpacks-cli-0:0.40.10-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-0:0.40.10-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le"
        },
        "product_reference": "buildpacks-cli-0:0.40.10-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-0:0.40.10-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x"
        },
        "product_reference": "buildpacks-cli-0:0.40.10-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-0:0.40.10-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64"
        },
        "product_reference": "buildpacks-cli-0:0.40.10-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64"
        },
        "product_reference": "buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le"
        },
        "product_reference": "buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x"
        },
        "product_reference": "buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64"
        },
        "product_reference": "buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64"
        },
        "product_reference": "buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le"
        },
        "product_reference": "buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x"
        },
        "product_reference": "buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64"
        },
        "product_reference": "buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64"
        },
        "product_reference": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le"
        },
        "product_reference": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x"
        },
        "product_reference": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
        },
        "product_reference": "buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-111943",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-111943"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-111943",
          "url": "https://www.suse.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286317 for CVE-2026-111943",
          "url": "https://bugzilla.suse.com/1286317"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-111943"
    },
    {
      "cve": "CVE-2026-17106",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-17106"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-17106",
          "url": "https://www.suse.com/security/cve/CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275243 for CVE-2026-17106",
          "url": "https://bugzilla.suse.com/1275243"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-17106"
    },
    {
      "cve": "CVE-2026-61801",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-61801"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-61801",
          "url": "https://www.suse.com/security/cve/CVE-2026-61801"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284848 for CVE-2026-61801",
          "url": "https://bugzilla.suse.com/1284848"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-61801"
    },
    {
      "cve": "CVE-2026-78659",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-78659"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-78659",
          "url": "https://www.suse.com/security/cve/CVE-2026-78659"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284768 for CVE-2026-78659",
          "url": "https://bugzilla.suse.com/1284768"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286134 for CVE-2026-78659",
          "url": "https://bugzilla.suse.com/1286134"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-78659"
    },
    {
      "cve": "CVE-2026-78662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-78662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, a channel registered in the mux\u0027s chanList is not usable until it is established. A malicious peer was able flood the channel\u0027s incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
          "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-78662",
          "url": "https://www.suse.com/security/cve/CVE-2026-78662"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-78662",
          "url": "https://bugzilla.suse.com/1278446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-78662",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-bash-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-fish-completion-0:0.40.10-1.1.x86_64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.aarch64",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.ppc64le",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.s390x",
            "openSUSE Tumbleweed:buildpacks-cli-zsh-completion-0:0.40.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-78662"
    }
  ]
}

CVE-2026-111943 (GCVE-0-2026-111943)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:52 – Updated: 2026-10-21 01:24

Title

Distrust compromised intermediate certificates in crypto/x509

Summary

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Severity

No CVSS data available.

CWE

CWE-299 - Improper Check for Certificate Revocation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/851047
https://go.dev/issue/82345
https://groups.google.com/g/golang-announce/c/66p…
https://pkg.go.dev/vuln/GO-2026-6809
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.26.10 (semver) Affected: 1.27.0-0 , < 1.27.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T01:24:20.498Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-299: Improper Check for Certificate Revocation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:52:18.359Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/851047"
        },
        {
          "url": "https://go.dev/issue/82345"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/66pojueaQek"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "title": "Distrust compromised intermediate certificates in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-111943",
    "datePublished": "2026-10-21T00:52:18.359Z",
    "dateReserved": "2026-10-17T13:43:28.599Z",
    "dateUpdated": "2026-10-21T01:24:20.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17106 (GCVE-0-2026-17106)

Vulnerability from cvelistv5 – Published: 2026-08-18 18:35 – Updated: 2026-08-19 03:56

Title

Tar extraction in moby/go-archive can write outside the destination directory via link following

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 00:00 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

Docker CNA under the mitre root

CNA scorecard B 88/100 over 34 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/moby/go-archive/security/advis…	vendor-advisory
https://docs.docker.com/desktop/release-notes/#4860	release-notes
https://github.com/docker/sbx-releases/releases/t…	release-notes
https://docs.docker.com/engine/release-notes/29/#2970	release-notes
https://github.com/docker/cli/releases/tag/v29.7.0	release-notes
https://github.com/docker/compose/releases/tag/v5.4.0	release-notes
https://github.com/moby/go-archive/releases/tag/v0.3.0	patch
https://github.com/masasron/CopyEscape-CVE-2026-17106	exploit

Impacted products

6 products

Vendor	Product	Version
moby	go-archive	Affected: 0 , < 0.3.0 (semver)
Docker	Docker Sandboxes	Affected: 0 , < 0.38.0 (semver) cpe:2.3:a:docker:docker_sandboxes::::::::
Docker	Docker Desktop	Affected: 0 , < 4.86.0 (semver) cpe:2.3:a:docker:desktop::::::::
Docker	Docker Engine	Affected: 0 , < 29.7.0 (semver)
Docker	Docker CLI	Affected: 0 , < 29.7.0 (semver)
Docker	Docker Compose	Affected: 0 , < 5.4.0 (semver)

Credits

Ron Masas (Imperva) and other independent reports

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17106",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T03:56:16.526Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/masasron/CopyEscape-CVE-2026-17106"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/moby/go-archive",
          "product": "go-archive",
          "vendor": "moby",
          "versions": [
            {
              "lessThan": "0.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:docker:docker_sandboxes:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux",
            "Windows"
          ],
          "product": "Docker Sandboxes",
          "vendor": "Docker",
          "versions": [
            {
              "lessThan": "0.38.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux",
            "Windows"
          ],
          "product": "Docker Desktop",
          "vendor": "Docker",
          "versions": [
            {
              "lessThan": "4.86.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux",
            "Windows"
          ],
          "product": "Docker Engine",
          "vendor": "Docker",
          "versions": [
            {
              "lessThan": "29.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux",
            "Windows"
          ],
          "product": "Docker CLI",
          "vendor": "Docker",
          "versions": [
            {
              "lessThan": "29.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux",
            "Windows"
          ],
          "product": "Docker Compose",
          "vendor": "Docker",
          "versions": [
            {
              "lessThan": "5.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron Masas (Imperva) and other independent reports"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process."
            }
          ],
          "value": "The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T18:35:13.465Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.docker.com/desktop/release-notes/#4860"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.docker.com/engine/release-notes/29/#2970"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/docker/cli/releases/tag/v29.7.0"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/docker/compose/releases/tag/v5.4.0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/moby/go-archive/releases/tag/v0.3.0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Tar extraction in moby/go-archive can write outside the destination directory via link following",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Only extract trusted archives."
            }
          ],
          "value": "Only extract trusted archives."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2026-17106",
    "datePublished": "2026-08-18T18:35:13.465Z",
    "dateReserved": "2026-07-24T15:24:25.317Z",
    "dateUpdated": "2026-08-19T03:56:16.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61801 (GCVE-0-2026-61801)

Vulnerability from cvelistv5 – Published: 2026-10-08 16:22 – Updated: 2026-10-08 17:27

Title

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Summary

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:27 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/moby/sys/security/advisories/G…	x_refsource_CONFIRM
https://github.com/moby/sys/pull/221	x_refsource_MISC
https://github.com/moby/sys/commit/85a71bbe1faa36…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moby	sys	Affected: < 0.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:27:31.522788Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:27:37.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sys",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T16:22:25.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw"
        },
        {
          "name": "https://github.com/moby/sys/pull/221",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/sys/pull/221"
        },
        {
          "name": "https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"
        }
      ],
      "source": {
        "advisory": "GHSA-mjcv-p78q-w5fw",
        "discovery": "UNKNOWN"
      },
      "title": "github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61801",
    "datePublished": "2026-10-08T16:22:25.558Z",
    "dateReserved": "2026-07-10T20:06:05.617Z",
    "dateUpdated": "2026-10-08T17:27:37.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78659 (GCVE-0-2026-78659)

Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 15:34

Title

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Summary

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 15:27 UTC

CWE

CWE-405 - Asymmetric Resource Consumption (Amplification)

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

6 references

URL	Tags
https://go.dev/cl/847185
https://go.dev/cl/847314
https://go.dev/issue/81857
https://groups.google.com/g/golang-announce/c/U2f…
https://groups.google.com/g/golang-announce/c/ZPw…
https://pkg.go.dev/vuln/GO-2026-6603

Impacted products

3 products

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.26.9 (semver)
Go standard library	net/http/internal/http2	Affected: 1.27.0-0 , < 1.27.2 (semver)
golang.org/x/net	golang.org/x/net/http2	Affected: 0 , < 0.60.0 (semver)

Credits

RyotaK (https://ryotak.net) of GMO Flatt Security Inc.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T15:27:33.510545Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-405",
                "description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:34:24.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "http2Framer.readMetaFrame"
            },
            {
              "name": "CanonicalHeaderKey"
            },
            {
              "name": "Client.CloseIdleConnections"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "Cookie.String"
            },
            {
              "name": "Cookie.Valid"
            },
            {
              "name": "CrossOriginProtection.AddInsecureBypassPattern"
            },
            {
              "name": "CrossOriginProtection.AddTrustedOrigin"
            },
            {
              "name": "CrossOriginProtection.Check"
            },
            {
              "name": "Dir.Open"
            },
            {
              "name": "Error"
            },
            {
              "name": "Get"
            },
            {
              "name": "Handle"
            },
            {
              "name": "HandleFunc"
            },
            {
              "name": "HandlerFunc.ServeHTTP"
            },
            {
              "name": "Head"
            },
            {
              "name": "Header.Add"
            },
            {
              "name": "Header.Del"
            },
            {
              "name": "Header.Get"
            },
            {
              "name": "Header.Set"
            },
            {
              "name": "Header.Values"
            },
            {
              "name": "Header.Write"
            },
            {
              "name": "Header.WriteSubset"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "NewRequest"
            },
            {
              "name": "NewRequestWithContext"
            },
            {
              "name": "NotFound"
            },
            {
              "name": "ParseCookie"
            },
            {
              "name": "ParseSetCookie"
            },
            {
              "name": "ParseTime"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            },
            {
              "name": "ProxyFromEnvironment"
            },
            {
              "name": "ReadRequest"
            },
            {
              "name": "ReadResponse"
            },
            {
              "name": "Redirect"
            },
            {
              "name": "Request.AddCookie"
            },
            {
              "name": "Request.BasicAuth"
            },
            {
              "name": "Request.Cookie"
            },
            {
              "name": "Request.Cookies"
            },
            {
              "name": "Request.CookiesNamed"
            },
            {
              "name": "Request.FormFile"
            },
            {
              "name": "Request.FormValue"
            },
            {
              "name": "Request.MultipartReader"
            },
            {
              "name": "Request.ParseForm"
            },
            {
              "name": "Request.ParseMultipartForm"
            },
            {
              "name": "Request.PostFormValue"
            },
            {
              "name": "Request.Referer"
            },
            {
              "name": "Request.SetBasicAuth"
            },
            {
              "name": "Request.UserAgent"
            },
            {
              "name": "Request.Write"
            },
            {
              "name": "Request.WriteProxy"
            },
            {
              "name": "Response.Cookies"
            },
            {
              "name": "Response.Location"
            },
            {
              "name": "Response.Write"
            },
            {
              "name": "ResponseController.EnableFullDuplex"
            },
            {
              "name": "ResponseController.Flush"
            },
            {
              "name": "ResponseController.Hijack"
            },
            {
              "name": "ResponseController.SetReadDeadline"
            },
            {
              "name": "ResponseController.SetWriteDeadline"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeContent"
            },
            {
              "name": "ServeFile"
            },
            {
              "name": "ServeFileFS"
            },
            {
              "name": "ServeMux.Handle"
            },
            {
              "name": "ServeMux.HandleFunc"
            },
            {
              "name": "ServeMux.ServeHTTP"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.Close"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            },
            {
              "name": "Server.SetKeepAlivesEnabled"
            },
            {
              "name": "Server.Shutdown"
            },
            {
              "name": "SetCookie"
            },
            {
              "name": "Transport.CancelRequest"
            },
            {
              "name": "Transport.Clone"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "body.Close"
            },
            {
              "name": "body.Read"
            },
            {
              "name": "bodyEOFSignal.Close"
            },
            {
              "name": "bodyEOFSignal.Read"
            },
            {
              "name": "bodyLocked.Read"
            },
            {
              "name": "bufioFlushWriter.Write"
            },
            {
              "name": "cancelTimerBody.Close"
            },
            {
              "name": "cancelTimerBody.Read"
            },
            {
              "name": "checkConnErrorWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "connReader.Read"
            },
            {
              "name": "connectMethodKey.String"
            },
            {
              "name": "expectContinueReader.Close"
            },
            {
              "name": "expectContinueReader.Read"
            },
            {
              "name": "extraHeader.Write"
            },
            {
              "name": "fileHandler.ServeHTTP"
            },
            {
              "name": "fileTransport.RoundTrip"
            },
            {
              "name": "globalOptionsHandler.ServeHTTP"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "http1ClientConn.Close"
            },
            {
              "name": "http1ClientConn.RoundTrip"
            },
            {
              "name": "http2ClientConn.Close"
            },
            {
              "name": "http2ClientConn.Ping"
            },
            {
              "name": "http2ClientConn.RoundTrip"
            },
            {
              "name": "http2ClientConn.Shutdown"
            },
            {
              "name": "http2ConnectionError.Error"
            },
            {
              "name": "http2ErrCode.String"
            },
            {
              "name": "http2FrameHeader.String"
            },
            {
              "name": "http2FrameType.String"
            },
            {
              "name": "http2FrameWriteRequest.String"
            },
            {
              "name": "http2Framer.ReadFrame"
            },
            {
              "name": "http2Framer.ReadFrameForHeader"
            },
            {
              "name": "http2Framer.ReadFrameHeader"
            },
            {
              "name": "http2Framer.WriteContinuation"
            },
            {
              "name": "http2Framer.WriteData"
            },
            {
              "name": "http2Framer.WriteDataPadded"
            },
            {
              "name": "http2Framer.WriteGoAway"
            },
            {
              "name": "http2Framer.WriteHeaders"
            },
            {
              "name": "http2Framer.WritePing"
            },
            {
              "name": "http2Framer.WritePriority"
            },
            {
              "name": "http2Framer.WritePushPromise"
            },
            {
              "name": "http2Framer.WriteRSTStream"
            },
            {
              "name": "http2Framer.WriteRawFrame"
            },
            {
              "name": "http2Framer.WriteSettings"
            },
            {
              "name": "http2Framer.WriteSettingsAck"
            },
            {
              "name": "http2Framer.WriteWindowUpdate"
            },
            {
              "name": "http2GoAwayError.Error"
            },
            {
              "name": "http2Server.ServeConn"
            },
            {
              "name": "http2Setting.String"
            },
            {
              "name": "http2SettingID.String"
            },
            {
              "name": "http2SettingsFrame.ForeachSetting"
            },
            {
              "name": "http2StreamError.Error"
            },
            {
              "name": "http2Transport.CloseIdleConnections"
            },
            {
              "name": "http2Transport.NewClientConn"
            },
            {
              "name": "http2Transport.RoundTrip"
            },
            {
              "name": "http2Transport.RoundTripOpt"
            },
            {
              "name": "http2bufferedWriter.Flush"
            },
            {
              "name": "http2bufferedWriter.Write"
            },
            {
              "name": "http2bufferedWriterTimeoutWriter.Write"
            },
            {
              "name": "http2chunkWriter.Write"
            },
            {
              "name": "http2clientConnPool.GetClientConn"
            },
            {
              "name": "http2connError.Error"
            },
            {
              "name": "http2dataBuffer.Read"
            },
            {
              "name": "http2duplicatePseudoHeaderError.Error"
            },
            {
              "name": "http2gzipReader.Close"
            },
            {
              "name": "http2gzipReader.Read"
            },
            {
              "name": "http2headerFieldNameError.Error"
            },
            {
              "name": "http2headerFieldValueError.Error"
            },
            {
              "name": "http2netHTTPClientConn.Close"
            },
            {
              "name": "http2netHTTPClientConn.RoundTrip"
            },
            {
              "name": "http2noDialClientConnPool.GetClientConn"
            },
            {
              "name": "http2noDialH2RoundTripper.NewClientConn"
            },
            {
              "name": "http2noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "http2pipe.Read"
            },
            {
              "name": "http2priorityWriteSchedulerRFC7540.CloseStream"
            },
            {
              "name": "http2priorityWriteSchedulerRFC7540.OpenStream"
            },
            {
              "name": "http2priorityWriteSchedulerRFC9218.OpenStream"
            },
            {
              "name": "http2pseudoHeaderError.Error"
            },
            {
              "name": "http2requestBody.Close"
            },
            {
              "name": "http2requestBody.Read"
            },
            {
              "name": "http2responseWriter.Flush"
            },
            {
              "name": "http2responseWriter.FlushError"
            },
            {
              "name": "http2responseWriter.Push"
            },
            {
              "name": "http2responseWriter.SetReadDeadline"
            },
            {
              "name": "http2responseWriter.SetWriteDeadline"
            },
            {
              "name": "http2responseWriter.Write"
            },
            {
              "name": "http2responseWriter.WriteHeader"
            },
            {
              "name": "http2responseWriter.WriteString"
            },
            {
              "name": "http2roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "http2serverConn.CloseConn"
            },
            {
              "name": "http2serverConn.Flush"
            },
            {
              "name": "http2stickyErrWriter.Write"
            },
            {
              "name": "http2transportResponseBody.Close"
            },
            {
              "name": "http2transportResponseBody.Read"
            },
            {
              "name": "http2unencryptedTransport.RoundTrip"
            },
            {
              "name": "http2writeData.String"
            },
            {
              "name": "initALPNRequest.ServeHTTP"
            },
            {
              "name": "loggingConn.Close"
            },
            {
              "name": "loggingConn.Read"
            },
            {
              "name": "loggingConn.Write"
            },
            {
              "name": "maxBytesReader.Close"
            },
            {
              "name": "maxBytesReader.Read"
            },
            {
              "name": "onceCloseListener.Close"
            },
            {
              "name": "persistConn.Read"
            },
            {
              "name": "persistConnWriter.ReadFrom"
            },
            {
              "name": "persistConnWriter.Write"
            },
            {
              "name": "populateResponse.Write"
            },
            {
              "name": "populateResponse.WriteHeader"
            },
            {
              "name": "readTrackingBody.Close"
            },
            {
              "name": "readTrackingBody.Read"
            },
            {
              "name": "readWriteCloserBody.CloseWrite"
            },
            {
              "name": "readWriteCloserBody.Read"
            },
            {
              "name": "redirectHandler.ServeHTTP"
            },
            {
              "name": "response.Flush"
            },
            {
              "name": "response.FlushError"
            },
            {
              "name": "response.Hijack"
            },
            {
              "name": "response.ReadFrom"
            },
            {
              "name": "response.Write"
            },
            {
              "name": "response.WriteHeader"
            },
            {
              "name": "response.WriteString"
            },
            {
              "name": "serverHandler.ServeHTTP"
            },
            {
              "name": "socksDialer.DialWithConn"
            },
            {
              "name": "socksUsernamePassword.Authenticate"
            },
            {
              "name": "stringWriter.WriteString"
            },
            {
              "name": "timeoutHandler.ServeHTTP"
            },
            {
              "name": "timeoutWriter.Write"
            },
            {
              "name": "timeoutWriter.WriteHeader"
            },
            {
              "name": "transportReadFromServerError.Error"
            },
            {
              "name": "unencryptedHTTP2Request.ServeHTTP"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http/internal/http2",
          "product": "net/http/internal/http2",
          "programRoutines": [
            {
              "name": "Framer.readMetaFrame"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.Ping"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "ClientConn.Shutdown"
            },
            {
              "name": "Framer.ReadFrame"
            },
            {
              "name": "Framer.ReadFrameForHeader"
            },
            {
              "name": "Framer.ReadFrameHeader"
            },
            {
              "name": "Framer.WriteContinuation"
            },
            {
              "name": "Framer.WriteData"
            },
            {
              "name": "Framer.WriteDataPadded"
            },
            {
              "name": "Framer.WriteGoAway"
            },
            {
              "name": "Framer.WriteHeaders"
            },
            {
              "name": "Framer.WritePing"
            },
            {
              "name": "Framer.WritePriority"
            },
            {
              "name": "Framer.WritePriorityUpdate"
            },
            {
              "name": "Framer.WritePushPromise"
            },
            {
              "name": "Framer.WriteRSTStream"
            },
            {
              "name": "Framer.WriteRawFrame"
            },
            {
              "name": "Framer.WriteSettings"
            },
            {
              "name": "Framer.WriteSettingsAck"
            },
            {
              "name": "Framer.WriteWindowUpdate"
            },
            {
              "name": "NetHTTPClientConn.Close"
            },
            {
              "name": "NetHTTPClientConn.Ping"
            },
            {
              "name": "NetHTTPClientConn.RoundTrip"
            },
            {
              "name": "ReadFrameHeader"
            },
            {
              "name": "Server.GracefulShutdown"
            },
            {
              "name": "Server.ServeConn"
            },
            {
              "name": "SettingsFrame.ForeachSetting"
            },
            {
              "name": "Transport.AddConn"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Transport.RoundTripOpt"
            },
            {
              "name": "bufferedWriter.Flush"
            },
            {
              "name": "bufferedWriter.Write"
            },
            {
              "name": "bufferedWriterTimeoutWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "clientConnPool.GetClientConn"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "noDialClientConnPool.GetClientConn"
            },
            {
              "name": "requestBody.Close"
            },
            {
              "name": "responseWriter.Flush"
            },
            {
              "name": "responseWriter.FlushError"
            },
            {
              "name": "responseWriter.Push"
            },
            {
              "name": "responseWriter.Write"
            },
            {
              "name": "responseWriter.WriteHeader"
            },
            {
              "name": "responseWriter.WriteString"
            },
            {
              "name": "serve400Handler.ServeHTTP"
            },
            {
              "name": "serverConn.Flush"
            },
            {
              "name": "stickyErrWriter.Write"
            },
            {
              "name": "transportResponseBody.Close"
            },
            {
              "name": "transportResponseBody.Read"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.27.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "Framer.readMetaFrame"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.Ping"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "ClientConn.Shutdown"
            },
            {
              "name": "ConfigureServer"
            },
            {
              "name": "ConfigureTransport"
            },
            {
              "name": "ConfigureTransports"
            },
            {
              "name": "ConnectionError.Error"
            },
            {
              "name": "ErrCode.String"
            },
            {
              "name": "FrameHeader.String"
            },
            {
              "name": "FrameType.String"
            },
            {
              "name": "FrameWriteRequest.String"
            },
            {
              "name": "Framer.ReadFrame"
            },
            {
              "name": "Framer.ReadFrameForHeader"
            },
            {
              "name": "Framer.ReadFrameHeader"
            },
            {
              "name": "Framer.WriteContinuation"
            },
            {
              "name": "Framer.WriteData"
            },
            {
              "name": "Framer.WriteDataPadded"
            },
            {
              "name": "Framer.WriteGoAway"
            },
            {
              "name": "Framer.WriteHeaders"
            },
            {
              "name": "Framer.WritePing"
            },
            {
              "name": "Framer.WritePriority"
            },
            {
              "name": "Framer.WritePriorityUpdate"
            },
            {
              "name": "Framer.WritePushPromise"
            },
            {
              "name": "Framer.WriteRSTStream"
            },
            {
              "name": "Framer.WriteRawFrame"
            },
            {
              "name": "Framer.WriteSettings"
            },
            {
              "name": "Framer.WriteSettingsAck"
            },
            {
              "name": "Framer.WriteWindowUpdate"
            },
            {
              "name": "GoAwayError.Error"
            },
            {
              "name": "ReadFrameHeader"
            },
            {
              "name": "Server.ServeConn"
            },
            {
              "name": "Setting.String"
            },
            {
              "name": "SettingID.String"
            },
            {
              "name": "SettingsFrame.ForeachSetting"
            },
            {
              "name": "StreamError.Error"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Transport.RoundTripOpt"
            },
            {
              "name": "bufferedWriter.Flush"
            },
            {
              "name": "bufferedWriter.Write"
            },
            {
              "name": "bufferedWriterTimeoutWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "clientConnPool.GetClientConn"
            },
            {
              "name": "connError.Error"
            },
            {
              "name": "dataBuffer.Read"
            },
            {
              "name": "duplicatePseudoHeaderError.Error"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "headerFieldNameError.Error"
            },
            {
              "name": "headerFieldValueError.Error"
            },
            {
              "name": "netHTTPClientConn.Close"
            },
            {
              "name": "netHTTPClientConn.RoundTrip"
            },
            {
              "name": "noDialClientConnPool.GetClientConn"
            },
            {
              "name": "noDialH2RoundTripper.NewClientConn"
            },
            {
              "name": "noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "pipe.Read"
            },
            {
              "name": "priorityWriteSchedulerRFC7540.CloseStream"
            },
            {
              "name": "priorityWriteSchedulerRFC7540.OpenStream"
            },
            {
              "name": "priorityWriteSchedulerRFC9218.OpenStream"
            },
            {
              "name": "pseudoHeaderError.Error"
            },
            {
              "name": "requestBody.Close"
            },
            {
              "name": "requestBody.Read"
            },
            {
              "name": "responseWriter.Flush"
            },
            {
              "name": "responseWriter.FlushError"
            },
            {
              "name": "responseWriter.Push"
            },
            {
              "name": "responseWriter.SetReadDeadline"
            },
            {
              "name": "responseWriter.SetWriteDeadline"
            },
            {
              "name": "responseWriter.Write"
            },
            {
              "name": "responseWriter.WriteHeader"
            },
            {
              "name": "responseWriter.WriteString"
            },
            {
              "name": "roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "serverConn.CloseConn"
            },
            {
              "name": "serverConn.Flush"
            },
            {
              "name": "stickyErrWriter.Write"
            },
            {
              "name": "transportResponseBody.Close"
            },
            {
              "name": "transportResponseBody.Read"
            },
            {
              "name": "unencryptedTransport.RoundTrip"
            },
            {
              "name": "writeData.String"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.60.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T22:53:58.192Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/847185"
        },
        {
          "url": "https://go.dev/cl/847314"
        },
        {
          "url": "https://go.dev/issue/81857"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6603"
        }
      ],
      "title": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-78659",
    "datePublished": "2026-10-08T22:53:58.192Z",
    "dateReserved": "2026-08-24T23:36:03.109Z",
    "dateUpdated": "2026-10-09T15:34:24.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78662 (GCVE-0-2026-78662)

Vulnerability from cvelistv5 – Published: 2026-09-02 19:37 – Updated: 2026-09-03 13:20

Title

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Summary

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 13:19 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/81316
https://go.dev/cl/826504
https://groups.google.com/g/golang-announce/c/1y3…
https://pkg.go.dev/vuln/GO-2026-6354

Impacted products

1 product

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.56.0 (semver)

Credits

Will Mortensen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T13:19:47.340520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T13:20:12.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "channel.handlePacket"
            },
            {
              "name": "channel.responseMessageReceived"
            },
            {
              "name": "channel.Accept"
            },
            {
              "name": "Dial"
            },
            {
              "name": "NewClientConn"
            },
            {
              "name": "NewControlClientConn"
            },
            {
              "name": "NewServerConn"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.56.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Will Mortensen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, a channel registered in the mux\u0027s chanList is not usable until it is established. A malicious peer was able flood the channel\u0027s incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T19:37:05.741Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/81316"
        },
        {
          "url": "https://go.dev/cl/826504"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/1y3fb2np35U"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6354"
        }
      ],
      "title": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-78662",
    "datePublished": "2026-09-02T19:37:05.741Z",
    "dateReserved": "2026-08-24T23:36:15.738Z",
    "dateUpdated": "2026-09-03T13:20:12.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12260-1

CVE-2026-111943 (GCVE-0-2026-111943)

CVE-2026-17106 (GCVE-0-2026-17106)

CVE-2026-61801 (GCVE-0-2026-61801)

CVE-2026-78659 (GCVE-0-2026-78659)

CVE-2026-78662 (GCVE-0-2026-78662)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour