Vulnerability-Lookup

SUSE-SU-2026:24247-1

Vulnerability from csaf_suse - Published: 2026-10-08 06:20 - Updated: 2026-10-21 11:50

Summary

Security update for helm

Severity

Important

Notes

Title of the patch: Security update for helm

Description of the patch: This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).

Patchnames: SUSE-SLES-16.0-1870

CVE-2026-63209

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-81870

2.5 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 12 products, the same list as for CVE-2026-63209

Threats

Impact moderate

CVE-2026-85732

4.7 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Affected products

Recommended 12 products, the same list as for CVE-2026-63209

Threats

Impact moderate

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://www.suse.com/support/update/announcement/…	self
https://bugzilla.suse.com/1281112	self
https://bugzilla.suse.com/1283642	self
https://bugzilla.suse.com/1284104	self
https://www.suse.com/security/cve/CVE-2026-63209/	self
https://www.suse.com/security/cve/CVE-2026-81870/	self
https://www.suse.com/security/cve/CVE-2026-85732/	self
https://www.suse.com/security/cve/CVE-2026-63209	external
https://bugzilla.suse.com/1283531	external
https://www.suse.com/security/cve/CVE-2026-81870	external
https://bugzilla.suse.com/1284104	external
https://www.suse.com/security/cve/CVE-2026-85732	external
https://bugzilla.suse.com/1281108	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for helm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for helm fixes the following issues:\n\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283642).\n- CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1870",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24247-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:24247-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624247-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:24247-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624247-1/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1281112",
        "url": "https://bugzilla.suse.com/1281112"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1283642",
        "url": "https://bugzilla.suse.com/1283642"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1284104",
        "url": "https://bugzilla.suse.com/1284104"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63209 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63209/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-81870 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-81870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-85732 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-85732/"
      }
    ],
    "title": "Security update for helm",
    "tracking": {
      "current_release_date": "2026-10-21T11:50:24Z",
      "generator": {
        "date": "2026-10-08T06:20:47Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:24247-1",
      "initial_release_date": "2026-10-08T06:20:47Z",
      "revision_history": [
        {
          "date": "2026-10-08T06:20:47Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-21T11:50:24Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-bash-completion-0:4.3.0-160000.2.1.noarch",
                "product": {
                  "name": "helm-bash-completion-0:4.3.0-160000.2.1.noarch",
                  "product_id": "helm-bash-completion-0:4.3.0-160000.2.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:4.3.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm-bash-completion@4.3.0-160000.2.1?arch=noarch\u0026upstream=helm-0:4.3.0-160000.2.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "helm-fish-completion-0:4.3.0-160000.2.1.noarch",
                "product": {
                  "name": "helm-fish-completion-0:4.3.0-160000.2.1.noarch",
                  "product_id": "helm-fish-completion-0:4.3.0-160000.2.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:4.3.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm-fish-completion@4.3.0-160000.2.1?arch=noarch\u0026upstream=helm-0:4.3.0-160000.2.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
                "product": {
                  "name": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
                  "product_id": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:4.3.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm-zsh-completion@4.3.0-160000.2.1?arch=noarch\u0026upstream=helm-0:4.3.0-160000.2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-0:4.3.0-160000.2.1.ppc64le",
                "product": {
                  "name": "helm-0:4.3.0-160000.2.1.ppc64le",
                  "product_id": "helm-0:4.3.0-160000.2.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:4.3.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@4.3.0-160000.2.1?arch=ppc64le\u0026upstream=helm-0:4.3.0-160000.2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-0:4.3.0-160000.2.1.s390x",
                "product": {
                  "name": "helm-0:4.3.0-160000.2.1.s390x",
                  "product_id": "helm-0:4.3.0-160000.2.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:4.3.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@4.3.0-160000.2.1?arch=s390x\u0026upstream=helm-0:4.3.0-160000.2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-0:4.3.0-160000.2.1.x86_64",
                "product": {
                  "name": "helm-0:4.3.0-160000.2.1.x86_64",
                  "product_id": "helm-0:4.3.0-160000.2.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:helm:helm:4.3.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/helm@4.3.0-160000.2.1?arch=x86_64\u0026upstream=helm-0:4.3.0-160000.2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-0:4.3.0-160000.2.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le"
        },
        "product_reference": "helm-0:4.3.0-160000.2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-0:4.3.0-160000.2.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x"
        },
        "product_reference": "helm-0:4.3.0-160000.2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-0:4.3.0-160000.2.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64"
        },
        "product_reference": "helm-0:4.3.0-160000.2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-0:4.3.0-160000.2.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch"
        },
        "product_reference": "helm-bash-completion-0:4.3.0-160000.2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-0:4.3.0-160000.2.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch"
        },
        "product_reference": "helm-fish-completion-0:4.3.0-160000.2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
        },
        "product_reference": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-0:4.3.0-160000.2.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le"
        },
        "product_reference": "helm-0:4.3.0-160000.2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-0:4.3.0-160000.2.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x"
        },
        "product_reference": "helm-0:4.3.0-160000.2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-0:4.3.0-160000.2.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64"
        },
        "product_reference": "helm-0:4.3.0-160000.2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-0:4.3.0-160000.2.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch"
        },
        "product_reference": "helm-bash-completion-0:4.3.0-160000.2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-fish-completion-0:4.3.0-160000.2.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch"
        },
        "product_reference": "helm-fish-completion-0:4.3.0-160000.2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
        },
        "product_reference": "helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-63209",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63209"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63209",
          "url": "https://www.suse.com/security/cve/CVE-2026-63209"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283531 for CVE-2026-63209",
          "url": "https://bugzilla.suse.com/1283531"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-08T06:20:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-63209"
    },
    {
      "cve": "CVE-2026-81870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-81870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-81870",
          "url": "https://www.suse.com/security/cve/CVE-2026-81870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284104 for CVE-2026-81870",
          "url": "https://bugzilla.suse.com/1284104"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-08T06:20:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-81870"
    },
    {
      "cve": "CVE-2026-85732",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-85732"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim\u0027s network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
          "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-85732",
          "url": "https://www.suse.com/security/cve/CVE-2026-85732"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1281108 for CVE-2026-85732",
          "url": "https://bugzilla.suse.com/1281108"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-0:4.3.0-160000.2.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-bash-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-fish-completion-0:4.3.0-160000.2.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:helm-zsh-completion-0:4.3.0-160000.2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-08T06:20:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-85732"
    }
  ]
}

CVE-2026-63209 (GCVE-0-2026-63209)

Vulnerability from cvelistv5 – Published: 2026-09-29 14:58 – Updated: 2026-09-29 16:32

Title

Integer Overflow or Wraparound and Out-of-bounds Write in compress

Summary

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:31 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-787 - Out-of-bounds Write

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8016 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/klauspost/compress/security/ad…	x_refsource_CONFIRM
https://github.com/klauspost/compress/commit/5392…	x_refsource_MISC
https://github.com/klauspost/compress/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
klauspost	compress	Affected: < 1.18.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:31:39.668233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:32:32.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compress",
          "vendor": "klauspost",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.18.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T14:58:53.366Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
        },
        {
          "name": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"
        },
        {
          "name": "https://github.com/klauspost/compress/releases/tag/v1.18.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klauspost/compress/releases/tag/v1.18.7"
        }
      ],
      "source": {
        "advisory": "GHSA-259r-337f-4rfw",
        "discovery": "UNKNOWN"
      },
      "title": "Integer Overflow or Wraparound and Out-of-bounds Write in compress"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63209",
    "datePublished": "2026-09-29T14:58:53.366Z",
    "dateReserved": "2026-07-15T22:19:06.906Z",
    "dateUpdated": "2026-09-29T16:32:32.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81870 (GCVE-0-2026-81870)

Vulnerability from cvelistv5 – Published: 2026-09-16 20:03 – Updated: 2026-09-17 14:58

Title

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 14:57 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8016 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-telemetry	opentelemetry-go	Affected: >= 1.5.0, < 1.45.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81870",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T14:57:11.645138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T14:58:07.997Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-go",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 1.45.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:03:28.737Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/8438",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/8438"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8wmf-6v46-5gfg",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-81870",
    "datePublished": "2026-09-16T20:03:28.737Z",
    "dateReserved": "2026-08-27T17:48:42.120Z",
    "dateUpdated": "2026-09-17T14:58:07.997Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85732 (GCVE-0-2026-85732)

Vulnerability from cvelistv5 – Published: 2026-09-16 16:22 – Updated: 2026-09-16 17:29

Title

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 17:29 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8016 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/oras-project/oras-go/security/…	x_refsource_CONFIRM
https://github.com/oras-project/oras-go/commit/31…	x_refsource_MISC
https://github.com/oras-project/oras-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
oras-project	oras-go	Affected: < 2.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:29:34.362450Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T17:29:51.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim\u0027s network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:22:14.881Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"
        },
        {
          "name": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"
        },
        {
          "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.2"
        }
      ],
      "source": {
        "advisory": "GHSA-h7vf-4x9w-h99v",
        "discovery": "UNKNOWN"
      },
      "title": "oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85732",
    "datePublished": "2026-09-16T16:22:14.881Z",
    "dateReserved": "2026-09-04T14:50:16.718Z",
    "dateUpdated": "2026-09-16T17:29:51.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:24247-1

CVE-2026-63209 (GCVE-0-2026-63209)

CVE-2026-81870 (GCVE-0-2026-81870)

CVE-2026-85732 (GCVE-0-2026-85732)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour