OPENSUSE-SU-2026:22224-1

Vulnerability from csaf_opensuse - Published: 2026-11-03 18:20 - Updated: 2026-11-04 21:58
Summary
Security update for rqlite
Severity
Critical
Notes
Title of the patch: Security update for rqlite
Description of the patch: This update for rqlite fixes the following issues: Changes in rqlite: - Update to version 10.6.6: * Keep the local auto-backup file if the metadata rename fails * Reject local auto-backup filenames reserved for internal use * POST /demote and POST /promote return a JSON error body, and 404 when the target node is not in the cluster. * DELETE /remove returns a JSON error body. - Includes changes from version 10.6.5: * Guard the inter-node backup stream handler directly against a missing backup request * POST /leader returns a JSON error body, and 404 when the target node is not in the cluster - Update to version 10.6.4: * BACKUP_STREAM authorization failures can disclose the database and crash rqlited (boo#1286934) * GET /leader returns a JSON error body when there is no leader * Close the connection after rejecting an unauthorized inter-node backup stream request, instead of streaming the database anyway * Decide inter-node command authorization once, before dispatch, and close the connection after rejecting any unauthorized command - Update to version 10.6.3: * Node probes honor request context and commit exactly one result * Make DB connections a first-class object * Prevent ATTACH on the query database connection - Update to version 10.6.2: * Check for trailing junk in request bodies * Console schema view handles table names that collide with JavaScript object properties * Set CommitTimestamps in CDC Events Group * Upgrade dependencies - Update to version 10.6.1: * Use constant-time comparison when comparing passwords * Conditionally rewrite SQL during queued writes and fix rewriting of CURRENT_TIMESTAMP and related tokens * More robust Leader stepdown node ID detection, reap checks, and SQL analyze start-time recording * CDC fixes: encode non-finite floats, always release flush waiters, and make the HTTP sink follow redirects * Converted _service from mode=disabled to mode=manual (legacy leftover; services are run by hand via osc service manualrun) * Package is not affected by CVE-2026-84445 (boo#1278793), CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253): vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes * Package is not affected by CVE-2026-89090 (boo#1280657): vendored eventstream is v1.7.20, above the v1.7.8 fix * Package is not affected by CVE-2026-63209 (boo#1283555): vendored klauspost/compress is v1.20.1, above the v1.18.7 fix * Package is not affected by CVE-2026-39821 (boo#1266544): vendored golang.org/x/net is v0.59.0, above the v0.55.0 fix - Update to version 10.6.0: * API addition: error_v2 may contain numeric SQLite error codes. * addresses a security issue related to Authentication files. A user with no explicit permissions could be grant elevated permissions. Correctly configured users do not suffer from this issue. * multiple implementation changes and bug fixes * Display interactive cluster topology on web console. * Support configurable queued-writes retries * release addresses a gap in the role-based access permissions related to change-data-capture (CDC) handling - Update to version 10.3.6: * Add query logging to database layer * Snapshot IDs now contain (optional) generation * Bump generation ID if snapshot IDs collide * Snapshots can be filtered by term and index * Add support for File Renaming and Removing with retries * Replace standard library with fsutil * Keep snapshot ordering correct regardless of clock * Remove snapshot name generation ID - Update to version 10.3.5: * Reject alternate form of unsupported PRAGMA commands * Handle negative trailing logs * Sync access to last backup time at http layer * Set the "Served by" header before first backup byte * Set DB load response time for all formats * Fix HTTP logic error for queued statements * Minor web console fixes - includes changes from 10.0.4: * Do not emit rolled-back events over CDC - includes changes from 10.0.3: * Refactor busy timeout methods * Fix edge-case bugs detected by GPT-6 Astra * Switch to quay.io/minio/minio:latest for testing purposes * Fix removing a node with different ID, but same Raft address * Use correct Foreign Key setting when recovering node * Only dump the indexes and triggers of the selected tables * Detect DB changes during Request(RETURNING) * Snapshot Open() first checks for failed reap * Sync snapshot plan directory * Propagate WAL stat errors * Clean up cancelled snapshots * Reject incomplete snapshot headers * Validate restore database header * Only reap a sole fullsnapshot if it has zero WALs * Keep database dumps consistent during writes to the database * Roll back DB Requests on statement-prepare errors - includes changes from 10.0.2: * Upgrade SQLite driver * Unit test reaping an installed Snapshot and streamed Snapshot combo * Use distinct Snapshot Namer type * Replace breaking-pragma regexes with ASCII prefix scanning * Consolidate pragma and txStatus reads onto a single connection per pool * Fix some magic strings in db package - Update to version 10.3.1: * Consolidate SQLite driver construction * Plumb Term and Index through during Snapshot Restore * Hard exit if FSM Restore fails post database-swap - Update to version 10.3.0: * Console app supports quickly querying for first 100 rows of a table * Rename read-only nodes to read replicas. Command-line flags unchanged * Bundles dependencies updated * Add infra for pushing OTLP metrics to an OpenTelemetry Collector * Add query logging at database level * Add CopyDir functionality to file utils. * Add ability to clone Snapshots, primarily for testing purposes * Store Index and Term in Fingerprint file and check during start-up - Update to version 10.2.7: * Remove explicit database-level read-only check from the pure Query path * Miscellaneous Store-level fixes related to resource management and shutdown sequence * Don't run CRC checks twice on Snapshot when fast-restart is explicitly disabled * Fixes to the http package including SQL rewriting control. * Address potential dropped CDC event on restart * Various minor fixes - includes changes from 10.2.6: * Handle a fully-executed Reap plan, but Plan file itself not removed * Close Snapshot streamer on error. - includes changes from 10.2.5: * Perform a Quick Integrity check after reaping snapshots, not Full - Update to version 10.2.4: * Fix some non-AWS S3-compatible stores - includes changes from 10.2.3 * Check snapshot store integrity before first actual use * Disable HTTP timeout for boot and restore operations via the shell * HTTP layer ignores ErrNoWALToSnapshot when snapshotting * Close Snapshot Streamer ASAP when restoring to local node
Patchnames: openSUSE-Leap-16.0-packagehub-725
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-39821
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-63209
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-39821
Threats
Impact important
CVE-2026-84303
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-39821
Threats
Impact critical
CVE-2026-84304
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-39821
Threats
Impact important
CVE-2026-84445
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-39821
Threats
Impact important
CVE-2026-89090
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-39821
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://bugzilla.suse.com/1266544 self
https://bugzilla.suse.com/1278793 self
https://bugzilla.suse.com/1279102 self
https://bugzilla.suse.com/1279253 self
https://bugzilla.suse.com/1280657 self
https://bugzilla.suse.com/1283555 self
https://bugzilla.suse.com/1286934 self
https://www.suse.com/security/cve/CVE-2026-39821/ self
https://www.suse.com/security/cve/CVE-2026-63209/ self
https://www.suse.com/security/cve/CVE-2026-84303/ self
https://www.suse.com/security/cve/CVE-2026-84304/ self
https://www.suse.com/security/cve/CVE-2026-84445/ self
https://www.suse.com/security/cve/CVE-2026-89090/ self
https://www.suse.com/security/cve/CVE-2026-39821 external
https://bugzilla.suse.com/1266474 external
https://www.suse.com/security/cve/CVE-2026-63209 external
https://bugzilla.suse.com/1283531 external
https://www.suse.com/security/cve/CVE-2026-84303 external
https://bugzilla.suse.com/1278268 external
https://bugzilla.suse.com/1280553 external
https://www.suse.com/security/cve/CVE-2026-84304 external
https://bugzilla.suse.com/1278271 external
https://bugzilla.suse.com/1280553 external
https://www.suse.com/security/cve/CVE-2026-84445 external
https://bugzilla.suse.com/1278687 external
https://bugzilla.suse.com/1280553 external
https://bugzilla.suse.com/1280617 external
https://www.suse.com/security/cve/CVE-2026-89090 external
https://bugzilla.suse.com/1280622 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for rqlite",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for rqlite fixes the following issues:\n\nChanges in rqlite:\n\n- Update to version 10.6.6:\n  * Keep the local auto-backup file if the metadata rename fails\n  * Reject local auto-backup filenames reserved for internal use\n  * POST /demote and POST /promote return a JSON error body, and\n    404 when the target node is not in the cluster.\n  * DELETE /remove returns a JSON error body.\n- Includes changes from  version 10.6.5:\n  * Guard the inter-node backup stream handler directly against a\n    missing backup request\n  * POST /leader returns a JSON error body, and 404 when the target\n    node is not in the cluster\n\n- Update to version 10.6.4:\n  * BACKUP_STREAM authorization failures can disclose the database\n    and crash rqlited (boo#1286934)\n  * GET /leader returns a JSON error body when there is no leader\n  * Close the connection after rejecting an unauthorized inter-node\n    backup stream request, instead of streaming the database anyway\n  * Decide inter-node command authorization once, before dispatch,\n    and close the connection after rejecting any unauthorized\n    command\n\n- Update to version 10.6.3:\n  * Node probes honor request context and commit exactly one\n    result\n  * Make DB connections a first-class object\n  * Prevent ATTACH on the query database connection\n\n- Update to version 10.6.2:\n  * Check for trailing junk in request bodies\n  * Console schema view handles table names that collide with\n    JavaScript object properties\n  * Set CommitTimestamps in CDC Events Group\n  * Upgrade dependencies\n\n- Update to version 10.6.1:\n  * Use constant-time comparison when comparing passwords\n  * Conditionally rewrite SQL during queued writes and fix\n    rewriting of CURRENT_TIMESTAMP and related tokens\n  * More robust Leader stepdown node ID detection, reap checks,\n    and SQL analyze start-time recording\n  * CDC fixes: encode non-finite floats, always release flush\n    waiters, and make the HTTP sink follow redirects\n  * Converted _service from mode=disabled to mode=manual (legacy\n    leftover; services are run by hand via osc service manualrun)\n  * Package is not affected by CVE-2026-84445 (boo#1278793),\n    CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):\n    vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes\n  * Package is not affected by CVE-2026-89090 (boo#1280657):\n    vendored eventstream is v1.7.20, above the v1.7.8 fix\n  * Package is not affected by CVE-2026-63209 (boo#1283555):\n    vendored klauspost/compress is v1.20.1, above the v1.18.7\n    fix\n  * Package is not affected by CVE-2026-39821 (boo#1266544):\n    vendored golang.org/x/net is v0.59.0, above the v0.55.0\n    fix\n\n- Update to version 10.6.0:\n  * API addition: error_v2 may contain numeric SQLite error codes.\n  * addresses a security issue related to Authentication files. A\n    user with no explicit permissions could be grant elevated\n    permissions. Correctly configured users do not suffer from this\n    issue.\n  * multiple implementation changes and bug fixes\n  * Display interactive cluster topology on web console.\n  * Support configurable queued-writes retries\n  * release addresses a gap in the role-based access permissions\n    related to change-data-capture (CDC) handling\n\n- Update to version 10.3.6:\n  * Add query logging to database layer\n  * Snapshot IDs now contain (optional) generation\n  * Bump generation ID if snapshot IDs collide\n  * Snapshots can be filtered by term and index\n  * Add support for File Renaming and Removing with retries\n  * Replace standard library with fsutil\n  * Keep snapshot ordering correct regardless of clock\n  * Remove snapshot name generation ID\n\n- Update to version 10.3.5:\n  * Reject alternate form of unsupported PRAGMA commands\n  * Handle negative trailing logs\n  * Sync access to last backup time at http layer\n  * Set the \"Served by\" header before first backup byte\n  * Set DB load response time for all formats\n  * Fix HTTP logic error for queued statements\n  * Minor web console fixes\n- includes changes from 10.0.4:\n  * Do not emit rolled-back events over CDC\n- includes changes from 10.0.3:\n  * Refactor busy timeout methods\n  * Fix edge-case bugs detected by GPT-6 Astra\n  * Switch to quay.io/minio/minio:latest for testing purposes\n  * Fix removing a node with different ID, but same Raft address\n  * Use correct Foreign Key setting when recovering node\n  * Only dump the indexes and triggers of the selected tables\n  * Detect DB changes during Request(RETURNING)\n  * Snapshot Open() first checks for failed reap\n  * Sync snapshot plan directory\n  * Propagate WAL stat errors\n  * Clean up cancelled snapshots\n  * Reject incomplete snapshot headers\n  * Validate restore database header\n  * Only reap a sole fullsnapshot if it has zero WALs\n  * Keep database dumps consistent during writes to the database\n  * Roll back DB Requests on statement-prepare errors\n- includes changes from 10.0.2:\n  * Upgrade SQLite driver\n  * Unit test reaping an installed Snapshot and streamed Snapshot combo\n  * Use distinct Snapshot Namer type\n  * Replace breaking-pragma regexes with ASCII prefix scanning\n  * Consolidate pragma and txStatus reads onto a single connection per pool\n  * Fix some magic strings in db package\n\n- Update to version 10.3.1:\n  * Consolidate SQLite driver construction\n  * Plumb Term and Index through during Snapshot Restore\n  * Hard exit if FSM Restore fails post database-swap\n\n- Update to version 10.3.0:\n  * Console app supports quickly querying for first 100 rows of a\n    table\n  * Rename read-only nodes to read replicas. Command-line flags\n    unchanged\n  * Bundles dependencies updated\n  * Add infra for pushing OTLP metrics to an OpenTelemetry\n    Collector\n  * Add query logging at database level\n  * Add CopyDir functionality to file utils.\n  * Add ability to clone Snapshots, primarily for testing purposes\n  * Store Index and Term in Fingerprint file and check during\n    start-up\n\n- Update to version 10.2.7:\n  * Remove explicit database-level read-only check from the pure\n    Query path\n  * Miscellaneous Store-level fixes related to resource management\n    and shutdown sequence\n  * Don\u0027t run CRC checks twice on Snapshot when fast-restart is\n    explicitly disabled\n  * Fixes to the http package including SQL rewriting control.\n  * Address potential dropped CDC event on restart\n  * Various minor fixes\n - includes changes from 10.2.6:\n  * Handle a fully-executed Reap plan, but Plan file itself not\n    removed\n  * Close Snapshot streamer on error.\n- includes changes from 10.2.5:\n  * Perform a Quick Integrity check after reaping snapshots, not\n    Full\n\n- Update to version 10.2.4:\n  * Fix some non-AWS S3-compatible stores\n- includes changes from 10.2.3\n  * Check snapshot store integrity before first actual use\n  * Disable HTTP timeout for boot and restore operations via the shell\n  * HTTP layer ignores ErrNoWALToSnapshot when snapshotting\n  * Close Snapshot Streamer ASAP when restoring to local node\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-725",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22224-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266544",
        "url": "https://bugzilla.suse.com/1266544"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1278793",
        "url": "https://bugzilla.suse.com/1278793"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1279102",
        "url": "https://bugzilla.suse.com/1279102"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1279253",
        "url": "https://bugzilla.suse.com/1279253"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1280657",
        "url": "https://bugzilla.suse.com/1280657"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1283555",
        "url": "https://bugzilla.suse.com/1283555"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1286934",
        "url": "https://bugzilla.suse.com/1286934"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63209 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63209/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84303 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84303/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84304 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84304/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84445 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84445/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-89090 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-89090/"
      }
    ],
    "title": "Security update for rqlite",
    "tracking": {
      "current_release_date": "2026-11-04T21:58:43Z",
      "generator": {
        "date": "2026-11-03T18:20:11Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:22224-1",
      "initial_release_date": "2026-11-03T18:20:11Z",
      "revision_history": [
        {
          "date": "2026-11-03T18:20:11Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-04T21:58:43Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rqlite-0:10.6.6-bp160.1.1.aarch64",
                "product": {
                  "name": "rqlite-0:10.6.6-bp160.1.1.aarch64",
                  "product_id": "rqlite-0:10.6.6-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/rqlite@10.6.6-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rqlite-0:10.6.6-bp160.1.1.ppc64le",
                "product": {
                  "name": "rqlite-0:10.6.6-bp160.1.1.ppc64le",
                  "product_id": "rqlite-0:10.6.6-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/rqlite@10.6.6-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rqlite-0:10.6.6-bp160.1.1.s390x",
                "product": {
                  "name": "rqlite-0:10.6.6-bp160.1.1.s390x",
                  "product_id": "rqlite-0:10.6.6-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/rqlite@10.6.6-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rqlite-0:10.6.6-bp160.1.1.x86_64",
                "product": {
                  "name": "rqlite-0:10.6.6-bp160.1.1.x86_64",
                  "product_id": "rqlite-0:10.6.6-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/rqlite@10.6.6-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rqlite-0:10.6.6-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64"
        },
        "product_reference": "rqlite-0:10.6.6-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rqlite-0:10.6.6-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le"
        },
        "product_reference": "rqlite-0:10.6.6-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rqlite-0:10.6.6-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x"
        },
        "product_reference": "rqlite-0:10.6.6-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rqlite-0:10.6.6-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        },
        "product_reference": "rqlite-0:10.6.6-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:20:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-63209",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63209"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63209",
          "url": "https://www.suse.com/security/cve/CVE-2026-63209"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283531 for CVE-2026-63209",
          "url": "https://bugzilla.suse.com/1283531"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:20:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63209"
    },
    {
      "cve": "CVE-2026-84303",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84303"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84303",
          "url": "https://www.suse.com/security/cve/CVE-2026-84303"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278268 for CVE-2026-84303",
          "url": "https://bugzilla.suse.com/1278268"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-84303",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:20:11Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-84303"
    },
    {
      "cve": "CVE-2026-84304",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84304"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84304",
          "url": "https://www.suse.com/security/cve/CVE-2026-84304"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278271 for CVE-2026-84304",
          "url": "https://bugzilla.suse.com/1278271"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-84304",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:20:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-84304"
    },
    {
      "cve": "CVE-2026-84445",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84445"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84445",
          "url": "https://www.suse.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278687 for CVE-2026-84445",
          "url": "https://bugzilla.suse.com/1278687"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-84445",
          "url": "https://bugzilla.suse.com/1280553"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280617 for CVE-2026-84445",
          "url": "https://bugzilla.suse.com/1280617"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:20:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-84445"
    },
    {
      "cve": "CVE-2026-89090",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-89090"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
          "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-89090",
          "url": "https://www.suse.com/security/cve/CVE-2026-89090"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280622 for CVE-2026-89090",
          "url": "https://bugzilla.suse.com/1280622"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.s390x",
            "openSUSE Leap 16.0:rqlite-0:10.6.6-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-89090"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.