Vulnerability-Lookup

SUSE-SU-2026:21793-1

Vulnerability from csaf_suse - Published: 2026-05-14 15:04 - Updated: 2026-05-14 15:04

Summary

Security update for alloy

Severity

Important

Notes

Title of the patch: Security update for alloy

Description of the patch: This update for alloy fixes the following issues Security issues: - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919). - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099). - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609). - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317). Non security issue: - Updated to 1.16.0 - Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)

Patchnames: SUSE-SLES-16.0-747

CVE-2026-25934

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-26958

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-33186

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-4427

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64	—	Vendor Fix

Threats

Impact important

References

20 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1258099	self
https://bugzilla.suse.com/1258609	self
https://bugzilla.suse.com/1259919	self
https://bugzilla.suse.com/1260317	self
https://www.suse.com/security/cve/CVE-2026-25934/	self
https://www.suse.com/security/cve/CVE-2026-26958/	self
https://www.suse.com/security/cve/CVE-2026-33186/	self
https://www.suse.com/security/cve/CVE-2026-4427/	self
https://www.suse.com/security/cve/CVE-2026-25934	external
https://bugzilla.suse.com/1258093	external
https://www.suse.com/security/cve/CVE-2026-26958	external
https://bugzilla.suse.com/1258570	external
https://www.suse.com/security/cve/CVE-2026-33186	external
https://bugzilla.suse.com/1260085	external
https://www.suse.com/security/cve/CVE-2026-4427	external
https://bugzilla.suse.com/1259910	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for alloy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for alloy fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server\n  to crash a client application via a DataRow message (bsc#1259919).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258099).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n  and lead to undefined behavior (bsc#1258609).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260317).\n\nNon security issue:\n\n- Updated to 1.16.0\n- Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-747",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21793-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:21793-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621793-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:21793-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-May/046820.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258099",
        "url": "https://bugzilla.suse.com/1258099"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258609",
        "url": "https://bugzilla.suse.com/1258609"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259919",
        "url": "https://bugzilla.suse.com/1259919"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260317",
        "url": "https://bugzilla.suse.com/1260317"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25934 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25934/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26958 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26958/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-4427 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-4427/"
      }
    ],
    "title": "Security update for alloy",
    "tracking": {
      "current_release_date": "2026-05-14T15:04:53Z",
      "generator": {
        "date": "2026-05-14T15:04:53Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:21793-1",
      "initial_release_date": "2026-05-14T15:04:53Z",
      "revision_history": [
        {
          "date": "2026-05-14T15:04:53Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-1.16.0-160000.1.1.aarch64",
                "product": {
                  "name": "alloy-1.16.0-160000.1.1.aarch64",
                  "product_id": "alloy-1.16.0-160000.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-1.16.0-160000.1.1.ppc64le",
                "product": {
                  "name": "alloy-1.16.0-160000.1.1.ppc64le",
                  "product_id": "alloy-1.16.0-160000.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-1.16.0-160000.1.1.s390x",
                "product": {
                  "name": "alloy-1.16.0-160000.1.1.s390x",
                  "product_id": "alloy-1.16.0-160000.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-1.16.0-160000.1.1.x86_64",
                "product": {
                  "name": "alloy-1.16.0-160000.1.1.x86_64",
                  "product_id": "alloy-1.16.0-160000.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-1.16.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
        },
        "product_reference": "alloy-1.16.0-160000.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-25934",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25934"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25934",
          "url": "https://www.suse.com/security/cve/CVE-2026-25934"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258093 for CVE-2026-25934",
          "url": "https://bugzilla.suse.com/1258093"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-14T15:04:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-25934"
    },
    {
      "cve": "CVE-2026-26958",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26958"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26958",
          "url": "https://www.suse.com/security/cve/CVE-2026-26958"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258570 for CVE-2026-26958",
          "url": "https://bugzilla.suse.com/1258570"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-14T15:04:53Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26958"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-14T15:04:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-4427",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-4427"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Duplicate of CVE-2026-32286",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-4427",
          "url": "https://www.suse.com/security/cve/CVE-2026-4427"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259910 for CVE-2026-4427",
          "url": "https://bugzilla.suse.com/1259910"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server 16.0:alloy-1.16.0-160000.1.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.16.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-14T15:04:53Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-4427"
    }
  ]
}

CVE-2026-25934 (GCVE-0-2026-25934)

Vulnerability from cvelistv5 – Published: 2026-02-09 22:13 – Updated: 2026-02-11 21:23

Title

go-git improperly verifies data integrity values for .idx and .pack files

Summary

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/go-git/go-git/security/advisor…	x_refsource_CONFIRM
https://github.com/go-git/go-git/releases/tag/v5.16.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
go-git	go-git	Affected: < 5.16.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25934",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T21:23:04.617787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T21:23:14.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-git",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.16.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354: Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T22:13:41.974Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3"
        },
        {
          "name": "https://github.com/go-git/go-git/releases/tag/v5.16.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/releases/tag/v5.16.5"
        }
      ],
      "source": {
        "advisory": "GHSA-37cx-329c-33x3",
        "discovery": "UNKNOWN"
      },
      "title": "go-git improperly verifies data integrity values for .idx and .pack files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25934",
    "datePublished": "2026-02-09T22:13:41.974Z",
    "dateReserved": "2026-02-09T16:22:17.786Z",
    "dateUpdated": "2026-02-11T21:23:14.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26958 (GCVE-0-2026-26958)

Vulnerability from cvelistv5 – Published: 2026-02-19 23:01 – Updated: 2026-02-20 15:39

Title

filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

Summary

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Severity

1.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-665 - Improper Initialization

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/FiloSottile/edwards25519/secur…	x_refsource_CONFIRM
https://github.com/FiloSottile/edwards25519/commi…	x_refsource_MISC
https://github.com/FiloSottile/edwards25519/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
FiloSottile	filippo.io/edwards25519	Affected: < 1.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26958",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T15:27:08.887006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:39:04.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "filippo.io/edwards25519",
          "vendor": "FiloSottile",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 1.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665: Improper Initialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T23:01:26.923Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hpr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/FiloSottile/edwards25519/security/advisories/GHSA-fw7p-63qq-7hpr"
        },
        {
          "name": "https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb"
        },
        {
          "name": "https://github.com/FiloSottile/edwards25519/releases/tag/v1.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FiloSottile/edwards25519/releases/tag/v1.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-fw7p-63qq-7hpr",
        "discovery": "UNKNOWN"
      },
      "title": "filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26958",
    "datePublished": "2026-02-19T23:01:26.923Z",
    "dateReserved": "2026-02-16T22:20:28.611Z",
    "dateUpdated": "2026-02-20T15:39:04.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33186 (GCVE-0-2026-33186)

Vulnerability from cvelistv5 – Published: 2026-03-20 22:23 – Updated: 2026-03-24 18:09

Title

gRPC-Go has an authorization bypass via missing leading slash in :path

Summary

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/grpc/grpc-go/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-go	Affected: < 1.79.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T18:08:38.989284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T18:09:13.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.79.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T22:23:32.147Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "source": {
        "advisory": "GHSA-p77j-4mvh-x3m3",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go has an authorization bypass via missing leading slash in :path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33186",
    "datePublished": "2026-03-20T22:23:32.147Z",
    "dateReserved": "2026-03-17T22:16:36.720Z",
    "dateUpdated": "2026-03-24T18:09:13.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4427 (GCVE-0-2026-4427)

Vulnerability from cvelistv5 – Published: 2026-03-19 14:24 – Updated: 2026-03-30 07:59

Duplicate of CVE-2026-32286

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-03-30T07:59:41.848Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "Duplicate of CVE-2026-32286"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-4427",
    "datePublished": "2026-03-19T14:24:02.864Z",
    "dateRejected": "2026-03-30T07:59:41.848Z",
    "dateReserved": "2026-03-19T12:54:24.750Z",
    "dateUpdated": "2026-03-30T07:59:41.848Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:21793-1

CVE-2026-25934 (GCVE-0-2026-25934)

CVE-2026-26958 (GCVE-0-2026-26958)

CVE-2026-33186 (GCVE-0-2026-33186)

CVE-2026-4427 (GCVE-0-2026-4427)

Tags

Sightings

Nomenclature