{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for cadvisor",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for cadvisor fixes the following issues:\n\nChanges in cadvisor:\n\n- update to 0.60.3:\n  * Move OOM watching out of the lib module into the binary\n  * lib/model: make ContainerStats sub-stats pointers to convey\n    collection presence\n- update to 0.60.1:\n  * cpuload/netlink: report the real error and skip the reader on\n    cgroup v2\n  * deploy: add lib/go.mod to the image build\u0027s dependency cache\n- update to 0.60.0:\n  * Exposing additional cgroup v2 memory.stat metrics\n  * lib: introduce github.com/google/cadvisor/lib \u2014 a lean,\n    kubelet-focused library module\n- bump x/net to 0.55 (bsc#1266645, CVE-2026-39821)\n\n- update to 0.57.0 (bsc#1260305, CVE-2026-33186):\n  * integration: add more Docker container handler tests\n  * integration: add containerd container handler tests\n  * integration: add Prometheus metrics endpoint tests\n  * fix: support podman `volatile-containers.json` and/or\n    `containers.json`\n  * proposed roadmap for cAdvisor\n  * remove log message when you can\u0027t read productName\n  * Refactor Github Action per b/485167538\n  * fix crio deadlock in getting crio sandbox containers\n  * Add container_creation_time_seconds (previously:\n    container_start_time_seconds); use runtime start time for\n    container_start_time_seconds (podman \u0026 docker)\n  * deps: github.com/moby/moby/client v0.4.0, moby/api v1.54.1,\n    containerd/ttrpc v1.2.8\n  * fix(build): update k8s-staging-test-infra image in integ\n    tests\n  * feat(manager/container): add configurable initial splay and\n    max jitter factors\n  * feat(manager): add constraint data in OOM events\n  * fix: add v-prefixed GHCR image tags for release consistency\n  * build(deps): bump the go_modules group across 2 directories\n    with 1 update\n  * Expose cgroup v2 memory.events as Prometheus metrics\n  * deploy: bump base images to Alpine 3.23\n\n- Update to version 0.56.2:\n  * docker: fix nil pointer dereference when GraphDriver is nil\n  * Update healthcheck.sh\n  * Update entrypoint.sh\n  * docker: migrate to github.com/moby/moby modules\n  * Update containerd, docker, moby, and opencontainers dependencies\n  * update README\n  * Update copyright year in healthcheck.sh\n  * Update copyright year in entrypoint.sh\n  * Added cadvisor boilerplate header to deploy/entrypoint.sh\n  * Added cadvisor boilerplate header to deploy/healthcheck.sh\n  * Add EXPOSE 8080 to document default port\n  * Fix healthcheck to respect custom port flag\n  * Add entrypoint wrapper to preserve -logtostderr flag\n  * add std in summary\n  * fix formatting\n  * Update container/docker/factory.go\n  * Update factory.go\n  * Update factory.go\n  * Update factory.go\n  * Fix for issue #3772\n  * docs: replace references to docker registry `gcr.io` with `ghcr.io`\n  * Expose s390x CPU Topology to Prometheus\n\n- update to 0.55.1:\n  * manager: fix race condition in Stop() using sync.Once\n  * manager: fix race condition in Stop() using sync.Once\n- update to 0.55.0:\n  * Reduce lock contention in manager package\n  * container/podman: fix `zfsFilesystem` and `zfsParent` being\n    swapped.\n  * devicemapper: use atomic.Value for lock-free cache reads\n  * Reduce lock contention in cache/memory package\n  * zfs: use atomic.Value for lock-free cache reads\n  * fix: docker health check status not updating\n  * align docker and podman implementations\n  * disable CGO for fully static binaries\n  * close stale PRs and Issues\n  * refactor(container): Migrate to std lib context package\n  * add workflow_dispatch to stale github action\n  * plugin factory: remove useless RegisterPlugin log output\n  * feat(summary): add count in percentiles\n  * machine: fixes for unix.Uname use\n  * feat: add LoadTaskProcess api in containerd client\n  * feat: add exit code in container deletion events\n  * feat: add CRI-O integration tests\n  * test: reorganize integration tests and add CRI-O test\n    coverage\n  * refactor: remove duplicate tests from api package and add\n    missing CRI-O tests\n  * fix: update golang.org/x/crypto to v0.45.0 to fix security\n    vulnerabilities\n  * container/(docker|podman): rewrite obtaining IP-address\n  * Upgrade GitHub Actions to latest versions\n  * Upgrade GitHub Actions for Node 24 compatibility\n  * feat: add fs io cost metrics\n  * go.mod: github.com/docker/go-connections v0.6.0\n  * fs: introduce pluggable filesystem architecture\n  * Apply build tags liberally for supported environments (linux)\n  * Replace godirwalk with os.ReadDir from standard library\n  * feat: add cpu burst metrics\n- update to 0.54.1:\n  * chore: update cAdvisor image registry and version in\n    DaemonSet\n  * ci: update Ubuntu version to 24.04 in GitHub Actions\n    workflows\n  * chore: re-enable golangci-lint checks and fix violations\n  * container/docker: GetStats: prevent nil-pointer\n- update to 0.54.0:\n  * Let us try to use ghcr.io for container images\n  * Add a GH action to create release binaries\n  * use qemu/docker to build arch specific binaries\n  * add -buildvcs=false to GH action\n  * fix(3643) add containerd-snapshotter support\n  * Update README.md with latest Docker image version and\n    registry\n  * Rebase to alpine 3.22, install thin-provisioning-tools from\n    main repo\n  * feat: add metric for container health check status  (DOCKER-\n    Specific!)\n  * Update golang and deps\n- update to version 0.54.1:\n  * container/docker: GetStats: prevent nil-pointer\n  * chore: re-enable golangci-lint checks and fix violations\n  * fix: use Docker-embedded containerd socket in integration tests\n  * refactor: remove Mesos container support\n  * ci: add diagnostic logging for docker/containerd debugging\n  * fix: persist containerd client error to prevent nil pointer dereference\n  * ci: update Ubuntu version to 24.04 in GitHub Actions workflows\n  * chore: update cAdvisor image registry and version in DaemonSet\n  * fix: handle nil Health state in docker container handler\n  * ci: update Go version to 1.25 in GitHub Actions workflows\n  * fix: update dependencies to address security vulnerabilities\n  * add health status tests\n  * feat: Update docker container handler to include health status in stats\n  * Rebase to alpine 3.22, install thin-provisioning-tools from main repo\n  * Update README.md Docker image reference\n  * fix(3643) add containerd-snapshotter support\n  * add -buildvcs=false to GH action\n  * use qemu/docker to build arch specific binaries\n  * Add a GH action to create release binaries\n  * Let us try to use ghcr.io for container images (#3699)\n\n- update to 0.53.0 (bsc#1257429, CVE-2024-45310,\n    bsc#1267788, CVE-2026-10722):\n  * fix potential hang on containerd client.LoadContainer\n  * Bump dependencies to latest (June 2, 2025)\n  * fix: fix call Errorf with wrong err\n  * Fixed possible data race\n  * Use built-in error wrapping instead of pkg/errors\n\n- update to 0.52.1:\n  * Make resctrl optional/pluggable\n- update to 0.52.0:\n  * bump containerd related deps: api v1.8.0; errdefs v1.0.0;\n    ttrpc v1.2.6\n  * chore: Update Prometheus libraries\n  * ci: golangci-lint bump, fixes, and cleanups\n  * bump runc to v1.2.4\n  * Add Pressure Stall Information Metrics\n  * Switch to opencontainers/cgroups repository (includes update\n    from golang 1.22 to 1.24)\n  * Bump to newer opencontainers/image-spec @ v1.1.1\n- update to 0.49.2:\n  * Cp fix test\n  * Revert \"reduce_logs_for_kubelet_use_crio\"\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-394",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21265-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239291",
        "url": "https://bugzilla.suse.com/1239291"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257429",
        "url": "https://bugzilla.suse.com/1257429"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260305",
        "url": "https://bugzilla.suse.com/1260305"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266645",
        "url": "https://bugzilla.suse.com/1266645"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267788",
        "url": "https://bugzilla.suse.com/1267788"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45310 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45310/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-10722 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-10722/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      }
    ],
    "title": "Security update for cadvisor",
    "tracking": {
      "current_release_date": "2026-09-17T17:38:08Z",
      "generator": {
        "date": "2026-07-06T16:05:20Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21265-1",
      "initial_release_date": "2026-07-06T16:05:20Z",
      "revision_history": [
        {
          "date": "2026-07-06T16:05:20Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-07-06T16:05:20Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:41:21Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:43:10Z",
          "number": "4",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:38:08Z",
          "number": "5",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cadvisor-0:0.60.3-bp160.1.1.aarch64",
                "product": {
                  "name": "cadvisor-0:0.60.3-bp160.1.1.aarch64",
                  "product_id": "cadvisor-0:0.60.3-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cadvisor@0.60.3-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cadvisor-0:0.60.3-bp160.1.1.ppc64le",
                "product": {
                  "name": "cadvisor-0:0.60.3-bp160.1.1.ppc64le",
                  "product_id": "cadvisor-0:0.60.3-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cadvisor@0.60.3-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cadvisor-0:0.60.3-bp160.1.1.s390x",
                "product": {
                  "name": "cadvisor-0:0.60.3-bp160.1.1.s390x",
                  "product_id": "cadvisor-0:0.60.3-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cadvisor@0.60.3-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cadvisor-0:0.60.3-bp160.1.1.x86_64",
                "product": {
                  "name": "cadvisor-0:0.60.3-bp160.1.1.x86_64",
                  "product_id": "cadvisor-0:0.60.3-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cadvisor@0.60.3-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cadvisor-0:0.60.3-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64"
        },
        "product_reference": "cadvisor-0:0.60.3-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cadvisor-0:0.60.3-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le"
        },
        "product_reference": "cadvisor-0:0.60.3-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cadvisor-0:0.60.3-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x"
        },
        "product_reference": "cadvisor-0:0.60.3-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cadvisor-0:0.60.3-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
        },
        "product_reference": "cadvisor-0:0.60.3-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45310",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45310"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack\u0027s scope but the exact scope of protection hasn\u0027t been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3.\n\nSome workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual\nuser on the host (such as with rootless containers that don\u0027t use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45310",
          "url": "https://www.suse.com/security/cve/CVE-2024-45310"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1230092 for CVE-2024-45310",
          "url": "https://bugzilla.suse.com/1230092"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257413 for CVE-2024-45310",
          "url": "https://bugzilla.suse.com/1257413"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-06T16:05:20Z",
          "details": "low"
        }
      ],
      "title": "CVE-2024-45310"
    },
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-06T16:05:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2026-10722",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-10722"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-10722",
          "url": "https://www.suse.com/security/cve/CVE-2026-10722"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267745 for CVE-2026-10722",
          "url": "https://bugzilla.suse.com/1267745"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-06T16:05:20Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-10722"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268676 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1268676"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-06T16:05:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
          "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.s390x",
            "openSUSE Leap 16.0:cadvisor-0:0.60.3-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-06T16:05:20Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    }
  ]
}