OPENSUSE-SU-2026:12309-1
Vulnerability from csaf_opensuse - Published: 2026-10-27 00:00 - Updated: 2026-10-28 11:19Summary
timoni-0.36.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: timoni-0.36.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the timoni-0.36.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12309
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.9 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
8.1 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
References
52 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "timoni-0.36.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the timoni-0.36.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-12309",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12309-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45338 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22872 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22872/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-100351 page",
"url": "https://www.suse.com/security/cve/CVE-2026-100351/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-100352 page",
"url": "https://www.suse.com/security/cve/CVE-2026-100352/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-100353 page",
"url": "https://www.suse.com/security/cve/CVE-2026-100353/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-100354 page",
"url": "https://www.suse.com/security/cve/CVE-2026-100354/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78659 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78659/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78660 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78660/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78663 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78663/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78669 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78669/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97032 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97032/"
}
],
"title": "timoni-0.36.0-1.1 on GA media",
"tracking": {
"current_release_date": "2026-10-28T11:19:40Z",
"generator": {
"date": "2026-10-27T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:12309-1",
"initial_release_date": "2026-10-27T00:00:00Z",
"revision_history": [
{
"date": "2026-10-27T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-28T11:19:40Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "timoni-0:0.36.0-1.1.aarch64",
"product": {
"name": "timoni-0:0.36.0-1.1.aarch64",
"product_id": "timoni-0:0.36.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni@0.36.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "timoni-bash-completion-0:0.36.0-1.1.aarch64",
"product": {
"name": "timoni-bash-completion-0:0.36.0-1.1.aarch64",
"product_id": "timoni-bash-completion-0:0.36.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-bash-completion@0.36.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "timoni-fish-completion-0:0.36.0-1.1.aarch64",
"product": {
"name": "timoni-fish-completion-0:0.36.0-1.1.aarch64",
"product_id": "timoni-fish-completion-0:0.36.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-fish-completion@0.36.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"product": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"product_id": "timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-zsh-completion@0.36.0-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "timoni-0:0.36.0-1.1.ppc64le",
"product": {
"name": "timoni-0:0.36.0-1.1.ppc64le",
"product_id": "timoni-0:0.36.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni@0.36.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"product": {
"name": "timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"product_id": "timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-bash-completion@0.36.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"product": {
"name": "timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"product_id": "timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-fish-completion@0.36.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"product": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"product_id": "timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-zsh-completion@0.36.0-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "timoni-0:0.36.0-1.1.s390x",
"product": {
"name": "timoni-0:0.36.0-1.1.s390x",
"product_id": "timoni-0:0.36.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni@0.36.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "timoni-bash-completion-0:0.36.0-1.1.s390x",
"product": {
"name": "timoni-bash-completion-0:0.36.0-1.1.s390x",
"product_id": "timoni-bash-completion-0:0.36.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-bash-completion@0.36.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "timoni-fish-completion-0:0.36.0-1.1.s390x",
"product": {
"name": "timoni-fish-completion-0:0.36.0-1.1.s390x",
"product_id": "timoni-fish-completion-0:0.36.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-fish-completion@0.36.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "timoni-zsh-completion-0:0.36.0-1.1.s390x",
"product": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.s390x",
"product_id": "timoni-zsh-completion-0:0.36.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-zsh-completion@0.36.0-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "timoni-0:0.36.0-1.1.x86_64",
"product": {
"name": "timoni-0:0.36.0-1.1.x86_64",
"product_id": "timoni-0:0.36.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni@0.36.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "timoni-bash-completion-0:0.36.0-1.1.x86_64",
"product": {
"name": "timoni-bash-completion-0:0.36.0-1.1.x86_64",
"product_id": "timoni-bash-completion-0:0.36.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-bash-completion@0.36.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "timoni-fish-completion-0:0.36.0-1.1.x86_64",
"product": {
"name": "timoni-fish-completion-0:0.36.0-1.1.x86_64",
"product_id": "timoni-fish-completion-0:0.36.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-fish-completion@0.36.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "timoni-zsh-completion-0:0.36.0-1.1.x86_64",
"product": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.x86_64",
"product_id": "timoni-zsh-completion-0:0.36.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/timoni-zsh-completion@0.36.0-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-0:0.36.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64"
},
"product_reference": "timoni-0:0.36.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-0:0.36.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le"
},
"product_reference": "timoni-0:0.36.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-0:0.36.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x"
},
"product_reference": "timoni-0:0.36.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-0:0.36.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64"
},
"product_reference": "timoni-0:0.36.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-bash-completion-0:0.36.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64"
},
"product_reference": "timoni-bash-completion-0:0.36.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-bash-completion-0:0.36.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le"
},
"product_reference": "timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-bash-completion-0:0.36.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x"
},
"product_reference": "timoni-bash-completion-0:0.36.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-bash-completion-0:0.36.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64"
},
"product_reference": "timoni-bash-completion-0:0.36.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-fish-completion-0:0.36.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64"
},
"product_reference": "timoni-fish-completion-0:0.36.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-fish-completion-0:0.36.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le"
},
"product_reference": "timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-fish-completion-0:0.36.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x"
},
"product_reference": "timoni-fish-completion-0:0.36.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-fish-completion-0:0.36.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64"
},
"product_reference": "timoni-fish-completion-0:0.36.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64"
},
"product_reference": "timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le"
},
"product_reference": "timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x"
},
"product_reference": "timoni-zsh-completion-0:0.36.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "timoni-zsh-completion-0:0.36.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
},
"product_reference": "timoni-zsh-completion-0:0.36.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45338"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45338",
"url": "https://www.suse.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "SUSE Bug 1234794 for CVE-2024-45338",
"url": "https://bugzilla.suse.com/1234794"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-45338"
},
{
"cve": "CVE-2025-22872",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22872"
}
],
"notes": [
{
"category": "general",
"text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22872",
"url": "https://www.suse.com/security/cve/CVE-2025-22872"
},
{
"category": "external",
"summary": "SUSE Bug 1241710 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1241710"
},
{
"category": "external",
"summary": "SUSE Bug 1265255 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265255"
},
{
"category": "external",
"summary": "SUSE Bug 1265256 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265256"
},
{
"category": "external",
"summary": "SUSE Bug 1265259 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265259"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-22872"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-100351",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-100351"
}
],
"notes": [
{
"category": "general",
"text": "kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-100351",
"url": "https://www.suse.com/security/cve/CVE-2026-100351"
},
{
"category": "external",
"summary": "SUSE Bug 1285801 for CVE-2026-100351",
"url": "https://bugzilla.suse.com/1285801"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-100351"
},
{
"cve": "CVE-2026-100352",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-100352"
}
],
"notes": [
{
"category": "general",
"text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi\u0027s existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-100352",
"url": "https://www.suse.com/security/cve/CVE-2026-100352"
},
{
"category": "external",
"summary": "SUSE Bug 1285807 for CVE-2026-100352",
"url": "https://bugzilla.suse.com/1285807"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-100352"
},
{
"cve": "CVE-2026-100353",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-100353"
}
],
"notes": [
{
"category": "general",
"text": "kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-100353",
"url": "https://www.suse.com/security/cve/CVE-2026-100353"
},
{
"category": "external",
"summary": "SUSE Bug 1285812 for CVE-2026-100353",
"url": "https://bugzilla.suse.com/1285812"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-100353"
},
{
"cve": "CVE-2026-100354",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-100354"
}
],
"notes": [
{
"category": "general",
"text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-100354",
"url": "https://www.suse.com/security/cve/CVE-2026-100354"
},
{
"category": "external",
"summary": "SUSE Bug 1285817 for CVE-2026-100354",
"url": "https://bugzilla.suse.com/1285817"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-100354"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-78659",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78659"
}
],
"notes": [
{
"category": "general",
"text": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78659",
"url": "https://www.suse.com/security/cve/CVE-2026-78659"
},
{
"category": "external",
"summary": "SUSE Bug 1284768 for CVE-2026-78659",
"url": "https://bugzilla.suse.com/1284768"
},
{
"category": "external",
"summary": "SUSE Bug 1286134 for CVE-2026-78659",
"url": "https://bugzilla.suse.com/1286134"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-78659"
},
{
"cve": "CVE-2026-78660",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78660"
}
],
"notes": [
{
"category": "general",
"text": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78660",
"url": "https://www.suse.com/security/cve/CVE-2026-78660"
},
{
"category": "external",
"summary": "SUSE Bug 1284769 for CVE-2026-78660",
"url": "https://bugzilla.suse.com/1284769"
},
{
"category": "external",
"summary": "SUSE Bug 1286129 for CVE-2026-78660",
"url": "https://bugzilla.suse.com/1286129"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-78660"
},
{
"cve": "CVE-2026-78663",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78663"
}
],
"notes": [
{
"category": "general",
"text": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78663",
"url": "https://www.suse.com/security/cve/CVE-2026-78663"
},
{
"category": "external",
"summary": "SUSE Bug 1284770 for CVE-2026-78663",
"url": "https://bugzilla.suse.com/1284770"
},
{
"category": "external",
"summary": "SUSE Bug 1286126 for CVE-2026-78663",
"url": "https://bugzilla.suse.com/1286126"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-78663"
},
{
"cve": "CVE-2026-78669",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78669"
}
],
"notes": [
{
"category": "general",
"text": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78669",
"url": "https://www.suse.com/security/cve/CVE-2026-78669"
},
{
"category": "external",
"summary": "SUSE Bug 1284772 for CVE-2026-78669",
"url": "https://bugzilla.suse.com/1284772"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-78669"
},
{
"cve": "CVE-2026-97032",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97032"
}
],
"notes": [
{
"category": "general",
"text": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder\u0027s table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97032",
"url": "https://www.suse.com/security/cve/CVE-2026-97032"
},
{
"category": "external",
"summary": "SUSE Bug 1284780 for CVE-2026-97032",
"url": "https://bugzilla.suse.com/1284780"
},
{
"category": "external",
"summary": "SUSE Bug 1286108 for CVE-2026-97032",
"url": "https://bugzilla.suse.com/1286108"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-bash-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-fish-completion-0:0.36.0-1.1.x86_64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.aarch64",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.ppc64le",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.s390x",
"openSUSE Tumbleweed:timoni-zsh-completion-0:0.36.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-97032"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.