OPENSUSE-SU-2026:22227-1

Vulnerability from csaf_opensuse - Published: 2026-11-03 18:16 - Updated: 2026-11-04 21:58
Summary
Security update for go-containerregistry
Severity
Important
Notes
Title of the patch: Security update for go-containerregistry
Description of the patch: This update for go-containerregistry fixes the following issues: Changes in go-containerregistry: - update vendor.tar to address: * bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic - update to 0.22.1: * Reject non-canonical IP literals in all SSRF guards * daemon: fix stale docker/docker reference in WithClient docs * build(deps): bump the go-deps group across 2 directories with 4 updates * authn: do not overwrite AuthConfig.Auth when username and password are empty * build(deps): bump the actions group across 1 directory with 8 updates * Support pulling images by sha512 digest * Allow empty label and annotation values in crane mutate * fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml * validate: support index attestation manifests and empty configs * name: improve error when parsing a reference with a URL scheme * fix(build): install binaries to /ko-app and add to PATH * fix(release): honor declared Go toolchain * remote: apply checkRedirectSSRF to writer-side HTTP clients * flatten: preserve config and layer media types when flattening * fix(mutate): make Time layer updates lazy * build(deps): bump the go-deps group across 2 directories with 3 updates * remote: copy manifest annotations to referrers fallback tag descriptors - update to 0.22.0: * mutate: let Time and Canonical take tarball.LayerOption * build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane * remote: resolve push-check credentials against the repository * Allow single-character repository paths * fix: add missing substitutions and workspace cleanup to new build files * remote: retry failed Puller and Pusher initialization * build(deps): bump the actions group across 1 directory with 8 updates * build(deps): bump the go-deps group across 1 directory with 3 updates * go.mod: bump Go version + add toolchain directive to replace .go-version file * fix: Fix new build options and provenance * fix(build): unify new build flow into cloudbuild_v2.yaml - update to 0.21.8 (bsc#1283692, CVE-2026-63209): * The artifacts attached to this release are missing SLSA provenance, see #2390. * build(deps): bump the go-deps group across 1 directory with 3 updates * build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane * build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain * build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes * build(deps): bump the go-deps group across 3 directories with 7 updates * build(deps): bump the actions group across 1 directory with 5 updates * Reject unsafe Windows archive paths in Extract * feat(goreleaser): add loong64 build support for crane/gcrane/krane * Document tag and digest reference semantics * remote: release pull limiter slot when body is read to EOF * tarball: bounds-check layer index in uncompressed LayerByDiffID * authn: read Podman auth from XDG config * transport: per-host bearer token exchange on cross-host redirect * mutate: bounds-check layer index when building rebase addendums * fix(daemon): copy ExposedPorts from source config in computeImageConfig * feat(remote): add WithReferrersTagFallback option * mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract * tarball: use correct file extension for zstd/uncompressed * build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory * actions: update actions to be pinned by hash * Bump go version to 1.26.5 - update to 0.21.7: * tarball: return error instead of panicking on missing rootfs.diff_ids * gcrane: honor --platform flag in copy * mutate: verify layer digests in Extract and Time * tarball: close layer readers during Write * build(deps): bump the actions group across 1 directory with 2 updates * build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory * BUGFIX: Fail with error when read exceeds maximum * build(deps): bump the actions group across 1 directory with 2 updates * fix(name): anchor loopback registry detection * Reject symlinks in OCI layout blobs * fix(crane): avoid creating export tar on pull failure * feat(kubernetes): allow ignoring pull secrets * fix(name): preserve localhost registry references * pkg/registry: export ErrNotFound * pkg/registry: export RedirectError * build(deps): bump the go-deps group across 1 directory with 2 updates * build(deps): bump the actions group across 1 directory with 2 updates * fix: prevent SSRF in google.List() pagination * internal/gzip: fix goroutine leak in ReadCloserLevel * fix(transport): apply refreshed bearer token after cross-host redirect * build(deps): bump the go-deps group across 3 directories with 4 updates * fix(tarball): normalize paths when matching files * transport: do not re-attach bearer token after cross-host redirect * Bump CI go version to 1.26.4 - update to 0.21.6: * fix: update dependencies to use new azure sdk components * transport: restore resp.Body in retryError so CheckError can parse it * pkg/registry: return 202 Accepted for PATCH chunk uploads * Follow OCI distribution spec for artifactType and annotations * actions: attach Codecov token to coverage tests on main * remote: use DeleteScope (with "delete" action) for manifest deletion * remote: limit concurrent layer pulls * pkg/registry: reject corrupt disk blobs * mutate: close layer readers during export * crane/flatten: preserve image media type when flattening * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 * build(deps): bump the go-deps group across 3 directories with 6 updates * Replace go-homedir with os.UserHomeDir * pkg/name: only treat .localhost as non-HTTPS, not .local * transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL * test(mutate): add Extract round-trip test for filesystem object preservation * experiments: remove deprecated support for estargz * build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group * fix: limit HTTP response body reads to prevent OOM * build(deps): bump the go-deps group across 3 directories with 6 updates * transport: block redirects from token server to private/link- local addresses (SSRF fix) * pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract * validate: skip non-layer layers * remote: validate foreign layer URLs to prevent SSRF (fixes #2259) * remote: block SSRF via private-IP Location headers in blob uploads * fix(mutate): preserve config blob and layers for non-Docker OCI artifacts * fix: preserve per-occurrence layer identity in mutate.Image.Layers() * transport: retry HTTP 429 (Too Many Requests) * transport: allow bearer realm at same host:port as registry * Update go version to 1.26.3 - update to 0.21.5: * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 * update to Go 1.26.2 * Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory * **Full Changelog**: https://github.com/google/go- containerregistry/compare/v0.21.4...v0.21.5 - update to 0.21.4: * go.mod: do not make a viral minimum go version * Avoid pruning absolute links from extracted and flattened images * Bump the go-deps group across 3 directories with 5 updates * fix: update to go1.25.8, and use separate .go-version file * Bump CI go version to 1.26.1 * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group * fork distribution client v3 auth-challenge as an internal package (squashed) * transport: validate Bearer realm URL to prevent SSRF * revert path traversal and symlink escape from #2227 * Fix pkg/v1/google/auth tests for arm64 * goreleaser: Update goreleaser config and GH action - update to 0.21.3: * Adds local file support to the `crane index` subcommand * migrate to github.com/moby/moby modules * Bump the go-deps group across 4 directories with 7 updates * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group * mutate: reject path traversal and symlink escape in Extract * tarball: detect symlink cycles in extractFileFromTar * bump golang to 1.25.7 - update to 0.21.2: * Better handle redirects to https in ping * **Full Changelog**: https://github.com/google/go- containerregistry/compare/v0.21.1...v0.21.2 - update to 0.21.1: * Add WithFileBufferedOpener for file-backed daemon image buffering * crane: fix case in auth response json - update to 0.21.0: * fix(mutate): don't skip dir replacements via whiteout in export * Improve performance of v1.NewHash * Bump the actions group across 1 directory with 4 updates * Bump the root-deps group across 1 directory with 7 updates * Fix error messages in crane_test.go * Bump go version across packages to 1.25.6 * Join go.mod dependency updates * Bump the go-deps group across 3 directories with 3 updates * Disable taint gosec lints * Update go version used in goreleaser - update to 0.20.7: * Fix ArgsEscaped lint directive * transport: Fix broken links to distribution docs * fix(remote): using customized retry predicate func if provided * Adding docker file * crane: Add timestamp to flatten layer * feat(remote): pass retryBackoff option to transport * Expose clobber refusal error * Build artifacts for riscv64 * Update dependencies and deprecate DockerVersion field - update to 0.20.7: * Fix ArgsEscaped lint directive * transport: Fix broken links to distribution docs * fix(remote): using customized retry predicate func if provided * Adding docker file * crane: Add timestamp to flatten layer * feat(remote): pass retryBackoff option to transport * Expose clobber refusal error * Build artifacts for riscv64 * Update dependencies and deprecate DockerVersion field - update to 0.20.6: * Ensure that tag name is not empty if name contains colon * Bump some deps - update to 0.20.5: * build(deps): bump docker/docker to v28.0.0+incompatible * Migrate linter to v2 * bump go version + bump deps * implement TextMarshaler/JSONMarshaler more consistently * Update CodeQL permissions * Update goreleaser permissions * Update provenance action in release * Update validator action - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239277) - update to 0.20.3: * remote/transport: Make bearer transport go-routine-safe * Expose compare package * fix: redact.URL uses (*URL).Redacted to omit basic-auth password * bump actions to latest * don't pin chainguard-dev/actions * Check for 406 status code when handling referrers API endpoint response * mutate: Create a defensive annotations copy * Detect zstd in crane append * bump deps using hack/bump-deps.sh - update to 0.20.2: * deps: bump docker dep
Patchnames: openSUSE-Leap-16.0-packagehub-728
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-22868
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-116591
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 18 products, the same list as for CVE-2025-22868
Threats
Impact important
CVE-2026-63209
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 18 products, the same list as for CVE-2025-22868
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for go-containerregistry",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for go-containerregistry fixes the following issues:\n\nChanges in go-containerregistry:\n\n- update vendor.tar to address:\n  * bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd:\n    crafted ~27 KB two-block zstd frame makes DecodeAll and the\n    streaming decoder panic\n\n- update to 0.22.1:\n  * Reject non-canonical IP literals in all SSRF guards\n  * daemon: fix stale docker/docker reference in WithClient docs\n  * build(deps): bump the go-deps group across 2 directories with\n    4 updates\n  * authn: do not overwrite AuthConfig.Auth when username and\n    password are empty\n  * build(deps): bump the actions group across 1 directory with 8\n    updates\n  * Support pulling images by sha512 digest\n  * Allow empty label and annotation values in crane mutate\n  * fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml\n  * validate: support index attestation manifests and empty\n    configs\n  * name: improve error when parsing a reference with a URL\n    scheme\n  * fix(build): install binaries to /ko-app and add to PATH\n  * fix(release): honor declared Go toolchain\n  * remote: apply checkRedirectSSRF to writer-side HTTP clients\n  * flatten: preserve config and layer media types when\n    flattening\n  * fix(mutate): make Time layer updates lazy\n  * build(deps): bump the go-deps group across 2 directories with\n    3 updates\n  * remote: copy manifest annotations to referrers fallback tag\n    descriptors\n\n- update to 0.22.0:\n  * mutate: let Time and Canonical take tarball.LayerOption\n  * build: add multi-architecture Cloud Build configurations for\n    crane, gcrane, and krane\n  * remote: resolve push-check credentials against the repository\n  * Allow single-character repository paths\n  * fix: add missing substitutions and workspace cleanup to new\n    build files\n  * remote: retry failed Puller and Pusher initialization\n  * build(deps): bump the actions group across 1 directory with 8\n    updates\n  * build(deps): bump the go-deps group across 1 directory with 3\n    updates\n  * go.mod: bump Go version + add toolchain directive to replace\n    .go-version file\n  * fix: Fix new build options and provenance\n  * fix(build): unify new build flow into cloudbuild_v2.yaml\n\n- update to 0.21.8 (bsc#1283692, CVE-2026-63209):\n  * The artifacts attached to this release are missing SLSA\n    provenance, see #2390.\n  * build(deps): bump the go-deps group across 1 directory with 3\n    updates\n  * build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0\n    in /cmd/krane\n  * build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0\n    in /pkg/authn/k8schain\n  * build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in\n    /pkg/authn/kubernetes\n  * build(deps): bump the go-deps group across 3 directories with\n    7 updates\n  * build(deps): bump the actions group across 1 directory with 5\n    updates\n  * Reject unsafe Windows archive paths in Extract\n  * feat(goreleaser): add loong64 build support for\n    crane/gcrane/krane\n  * Document tag and digest reference semantics\n  * remote: release pull limiter slot when body is read to EOF\n  * tarball: bounds-check layer index in uncompressed\n    LayerByDiffID\n  * authn: read Podman auth from XDG config\n  * transport: per-host bearer token exchange on cross-host\n    redirect\n  * mutate: bounds-check layer index when building rebase\n    addendums\n  * fix(daemon): copy ExposedPorts from source config in\n    computeImageConfig\n  * feat(remote): add WithReferrersTagFallback option\n  * mutate: apply opaque-directory whiteouts (.wh..wh..opq) in\n    Extract\n  * tarball: use correct file extension for zstd/uncompressed\n  * build(deps): bump github.com/moby/moby/client from 0.5.0 to\n    0.5.1 in the go-deps group across 1 directory\n  * actions: update actions to be pinned by hash\n  * Bump go version to 1.26.5\n\n- update to 0.21.7:\n  * tarball: return error instead of panicking on missing\n    rootfs.diff_ids\n  * gcrane: honor --platform flag in copy\n  * mutate: verify layer digests in Extract and Time\n  * tarball: close layer readers during Write\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * build(deps): bump github.com/docker/cli from\n    29.4.3+incompatible to 29.5.2+incompatible in the go-deps\n    group across 1 directory\n  * BUGFIX: Fail with error when read exceeds maximum\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * fix(name): anchor loopback registry detection\n  * Reject symlinks in OCI layout blobs\n  * fix(crane): avoid creating export tar on pull failure\n  * feat(kubernetes): allow ignoring pull secrets\n  * fix(name): preserve localhost registry references\n  * pkg/registry: export ErrNotFound\n  * pkg/registry: export RedirectError\n  * build(deps): bump the go-deps group across 1 directory with 2\n    updates\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * fix: prevent SSRF in google.List() pagination\n  * internal/gzip: fix goroutine leak in ReadCloserLevel\n  * fix(transport): apply refreshed bearer token after cross-host\n    redirect\n  * build(deps): bump the go-deps group across 3 directories with\n    4 updates\n  * fix(tarball): normalize paths when matching files\n  * transport: do not re-attach bearer token after cross-host\n    redirect\n  * Bump CI go version to 1.26.4\n- update to 0.21.6:\n  * fix: update dependencies to use new azure sdk components\n  * transport: restore resp.Body in retryError so CheckError can\n    parse it\n  * pkg/registry: return 202 Accepted for PATCH chunk uploads\n  * Follow OCI distribution spec for artifactType and annotations\n  * actions: attach Codecov token to coverage tests on main\n  * remote: use DeleteScope (with \"delete\" action) for manifest\n    deletion\n  * remote: limit concurrent layer pulls\n  * pkg/registry: reject corrupt disk blobs\n  * mutate: close layer readers during export\n  * crane/flatten: preserve image media type when flattening\n  * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to\n    7.2.1 in the actions group across 1 directory\n  * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to\n    1.41.0\n  * build(deps): bump the go-deps group across 3 directories with\n    6 updates\n  * Replace go-homedir with os.UserHomeDir\n  * pkg/name: only treat .localhost as non-HTTPS, not .local\n  * transport: block unspecified IPs (0.0.0.0, ::) in\n    validateRealmURL\n  * test(mutate): add Extract round-trip test for filesystem\n    object preservation\n  * experiments: remove deprecated support for estargz\n  * build(deps): bump aws-actions/configure-aws-credentials from\n    6.1.0 to 6.1.1 in the actions group\n  * fix: limit HTTP response body reads to prevent OOM\n  * build(deps): bump the go-deps group across 3 directories with\n    6 updates\n  * transport: block redirects from token server to private/link-\n    local addresses (SSRF fix)\n  * pkg/v1/mutate: preserve relative symlinks that stay within\n    rootfs in Extract\n  * validate: skip non-layer layers\n  * remote: validate foreign layer URLs to prevent SSRF (fixes\n    #2259)\n  * remote: block SSRF via private-IP Location headers in blob\n    uploads\n  * fix(mutate): preserve config blob and layers for non-Docker\n    OCI artifacts\n  * fix: preserve per-occurrence layer identity in\n    mutate.Image.Layers()\n  * transport: retry HTTP 429 (Too Many Requests)\n  * transport: allow bearer realm at same host:port as registry\n  * Update go version to 1.26.3\n- update to 0.21.5:\n  * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0\n  * update to Go 1.26.2\n  * Bump aws-actions/configure-aws-credentials from 6.0.0 to\n    6.1.0 in the actions group across 1 directory\n  * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in\n    the go-deps group across 1 directory\n  * **Full Changelog**: https://github.com/google/go-\n    containerregistry/compare/v0.21.4...v0.21.5\n- update to 0.21.4:\n  * go.mod: do not make a viral minimum go version\n  * Avoid pruning absolute links from extracted and flattened\n    images\n  * Bump the go-deps group across 3 directories with 5 updates\n  * fix: update to go1.25.8, and use separate .go-version file\n  * Bump CI go version to 1.26.1\n  * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the\n    actions group\n  * fork distribution client v3 auth-challenge as an internal\n    package (squashed)\n  * transport: validate Bearer realm URL to prevent SSRF\n  * revert path traversal and symlink escape from #2227\n  * Fix pkg/v1/google/auth tests for arm64\n  * goreleaser: Update goreleaser config and GH action\n\n- update to 0.21.3:\n  * Adds local file support to the `crane index` subcommand\n  * migrate to github.com/moby/moby modules\n  * Bump the go-deps group across 4 directories with 7 updates\n  * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the\n    actions group\n  * mutate: reject path traversal and symlink escape in Extract\n  * tarball: detect symlink cycles in extractFileFromTar\n  * bump golang to 1.25.7\n- update to 0.21.2:\n  * Better handle redirects to https in ping\n  * **Full Changelog**: https://github.com/google/go-\n    containerregistry/compare/v0.21.1...v0.21.2\n\n- update to 0.21.1:\n  * Add WithFileBufferedOpener for file-backed daemon image\n    buffering\n  * crane: fix case in auth response json\n- update to 0.21.0:\n  * fix(mutate): don\u0027t skip dir replacements via whiteout in\n    export\n  * Improve performance of v1.NewHash\n  * Bump the actions group across 1 directory with 4 updates\n  * Bump the root-deps group across 1 directory with 7 updates\n  * Fix error messages in crane_test.go\n  * Bump go version across packages to 1.25.6\n  * Join go.mod dependency updates\n  * Bump the go-deps group across 3 directories with 3 updates\n  * Disable taint gosec lints\n  * Update go version used in goreleaser\n- update to 0.20.7:\n  * Fix ArgsEscaped lint directive\n  * transport: Fix broken links to distribution docs\n  * fix(remote): using customized retry predicate func if\n    provided\n  * Adding docker file\n  * crane: Add timestamp to flatten layer\n  * feat(remote): pass retryBackoff option to transport\n  * Expose clobber refusal error\n  * Build artifacts for riscv64\n  * Update dependencies and deprecate DockerVersion field\n\n- update to 0.20.7:\n  * Fix ArgsEscaped lint directive\n  * transport: Fix broken links to distribution docs\n  * fix(remote): using customized retry predicate func if\n    provided\n  * Adding docker file\n  * crane: Add timestamp to flatten layer\n  * feat(remote): pass retryBackoff option to transport\n  * Expose clobber refusal error\n  * Build artifacts for riscv64\n  * Update dependencies and deprecate DockerVersion field\n\n\n- update to 0.20.6:\n  * Ensure that tag name is not empty if name contains colon\n  * Bump some deps\n- update to 0.20.5:\n  * build(deps): bump docker/docker to v28.0.0+incompatible\n  * Migrate linter to v2\n  * bump go version + bump deps\n  * implement TextMarshaler/JSONMarshaler more consistently\n  * Update CodeQL permissions\n  * Update goreleaser permissions\n  * Update provenance action in release\n  * Update validator action\n\n- CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption\n  during token parsing in golang.org/x/oauth2 (bsc#1239277)\n\n- update to 0.20.3:\n  * remote/transport: Make bearer transport go-routine-safe\n  * Expose compare package\n  * fix: redact.URL uses (*URL).Redacted to omit basic-auth\n    password\n  * bump actions to latest\n  * don\u0027t pin chainguard-dev/actions\n  * Check for 406 status code when handling referrers API\n    endpoint response\n  * mutate: Create a defensive annotations copy\n  * Detect zstd in crane append\n  * bump deps using hack/bump-deps.sh\n- update to 0.20.2:\n  * deps: bump docker dep\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-728",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22227-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239277",
        "url": "https://bugzilla.suse.com/1239277"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1283692",
        "url": "https://bugzilla.suse.com/1283692"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1288488",
        "url": "https://bugzilla.suse.com/1288488"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-116591 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-116591/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63209 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63209/"
      }
    ],
    "title": "Security update for go-containerregistry",
    "tracking": {
      "current_release_date": "2026-11-04T21:58:45Z",
      "generator": {
        "date": "2026-11-03T18:16:30Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:22227-1",
      "initial_release_date": "2026-11-03T18:16:30Z",
      "revision_history": [
        {
          "date": "2026-11-03T18:16:30Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-04T21:58:45Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "crane-0:0.22.1-bp160.1.1.aarch64",
                "product": {
                  "name": "crane-0:0.22.1-bp160.1.1.aarch64",
                  "product_id": "crane-0:0.22.1-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane@0.22.1-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-0:0.22.1-bp160.1.1.aarch64",
                "product": {
                  "name": "gcrane-0:0.22.1-bp160.1.1.aarch64",
                  "product_id": "gcrane-0:0.22.1-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane@0.22.1-bp160.1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
                "product": {
                  "name": "go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
                  "product_id": "go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/go-containerregistry@0.22.1-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
                "product": {
                  "name": "crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_id": "crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane-bash-completion@0.22.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
                "product": {
                  "name": "crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_id": "crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane-fish-completion@0.22.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
                "product": {
                  "name": "crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_id": "crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane-zsh-completion@0.22.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
                "product": {
                  "name": "gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_id": "gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane-bash-completion@0.22.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
                "product": {
                  "name": "gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_id": "gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane-fish-completion@0.22.1-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
                "product": {
                  "name": "gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_id": "gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane-zsh-completion@0.22.1-bp160.1.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "crane-0:0.22.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "crane-0:0.22.1-bp160.1.1.ppc64le",
                  "product_id": "crane-0:0.22.1-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane@0.22.1-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-0:0.22.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "gcrane-0:0.22.1-bp160.1.1.ppc64le",
                  "product_id": "gcrane-0:0.22.1-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane@0.22.1-bp160.1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
                  "product_id": "go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/go-containerregistry@0.22.1-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "crane-0:0.22.1-bp160.1.1.s390x",
                "product": {
                  "name": "crane-0:0.22.1-bp160.1.1.s390x",
                  "product_id": "crane-0:0.22.1-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane@0.22.1-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-0:0.22.1-bp160.1.1.s390x",
                "product": {
                  "name": "gcrane-0:0.22.1-bp160.1.1.s390x",
                  "product_id": "gcrane-0:0.22.1-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane@0.22.1-bp160.1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-containerregistry-0:0.22.1-bp160.1.1.s390x",
                "product": {
                  "name": "go-containerregistry-0:0.22.1-bp160.1.1.s390x",
                  "product_id": "go-containerregistry-0:0.22.1-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/go-containerregistry@0.22.1-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "crane-0:0.22.1-bp160.1.1.x86_64",
                "product": {
                  "name": "crane-0:0.22.1-bp160.1.1.x86_64",
                  "product_id": "crane-0:0.22.1-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/crane@0.22.1-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gcrane-0:0.22.1-bp160.1.1.x86_64",
                "product": {
                  "name": "gcrane-0:0.22.1-bp160.1.1.x86_64",
                  "product_id": "gcrane-0:0.22.1-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gcrane@0.22.1-bp160.1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "go-containerregistry-0:0.22.1-bp160.1.1.x86_64",
                "product": {
                  "name": "go-containerregistry-0:0.22.1-bp160.1.1.x86_64",
                  "product_id": "go-containerregistry-0:0.22.1-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/go-containerregistry@0.22.1-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-0:0.22.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64"
        },
        "product_reference": "crane-0:0.22.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-0:0.22.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le"
        },
        "product_reference": "crane-0:0.22.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-0:0.22.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x"
        },
        "product_reference": "crane-0:0.22.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-0:0.22.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64"
        },
        "product_reference": "crane-0:0.22.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-bash-completion-0:0.22.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch"
        },
        "product_reference": "crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-fish-completion-0:0.22.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch"
        },
        "product_reference": "crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "crane-zsh-completion-0:0.22.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch"
        },
        "product_reference": "crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-0:0.22.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64"
        },
        "product_reference": "gcrane-0:0.22.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-0:0.22.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le"
        },
        "product_reference": "gcrane-0:0.22.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-0:0.22.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x"
        },
        "product_reference": "gcrane-0:0.22.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-0:0.22.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64"
        },
        "product_reference": "gcrane-0:0.22.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch"
        },
        "product_reference": "gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch"
        },
        "product_reference": "gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch"
        },
        "product_reference": "gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-containerregistry-0:0.22.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64"
        },
        "product_reference": "go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-containerregistry-0:0.22.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le"
        },
        "product_reference": "go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-containerregistry-0:0.22.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x"
        },
        "product_reference": "go-containerregistry-0:0.22.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-containerregistry-0:0.22.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
        },
        "product_reference": "go-containerregistry-0:0.22.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:16:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2026-116591",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-116591"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-116591",
          "url": "https://www.suse.com/security/cve/CVE-2026-116591"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288411 for CVE-2026-116591",
          "url": "https://bugzilla.suse.com/1288411"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:16:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-116591"
    },
    {
      "cve": "CVE-2026-63209",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63209"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63209",
          "url": "https://www.suse.com/security/cve/CVE-2026-63209"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283531 for CVE-2026-63209",
          "url": "https://bugzilla.suse.com/1283531"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:crane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:crane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:crane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gcrane-0:0.22.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gcrane-bash-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-fish-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gcrane-zsh-completion-0:0.22.1-bp160.1.1.noarch",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:go-containerregistry-0:0.22.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T18:16:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63209"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.