Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-56852 (GCVE-0-2026-56852)
Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57
VLAI
EPSS
VEX
Title
Infinite loop on invalid input in golang.org/x/text
Summary
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:26 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| golang.org/x/text | golang.org/x/text/unicode/norm |
Affected:
0 , < 0.39.0
(semver)
|
guessed |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:26:14.918983Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:26:20.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/text/unicode/norm",
"product": "golang.org/x/text/unicode/norm",
"programRoutines": [
{
"name": "nextComposed"
},
{
"name": "Form.Append"
},
{
"name": "Form.AppendString"
},
{
"name": "Form.Bytes"
},
{
"name": "Form.FirstBoundary"
},
{
"name": "Form.FirstBoundaryInString"
},
{
"name": "Form.IsNormal"
},
{
"name": "Form.IsNormalString"
},
{
"name": "Form.LastBoundary"
},
{
"name": "Form.NextBoundary"
},
{
"name": "Form.NextBoundaryInString"
},
{
"name": "Form.Properties"
},
{
"name": "Form.PropertiesString"
},
{
"name": "Form.QuickSpan"
},
{
"name": "Form.QuickSpanString"
},
{
"name": "Form.Span"
},
{
"name": "Form.SpanString"
},
{
"name": "Form.String"
},
{
"name": "Form.Transform"
},
{
"name": "Iter.Init"
},
{
"name": "Iter.InitString"
},
{
"name": "Iter.Next"
},
{
"name": "Iter.Seek"
},
{
"name": "normReader.Read"
},
{
"name": "normWriter.Write"
}
],
"vendor": "golang.org/x/text",
"versions": [
{
"lessThan": "0.39.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Viky Choi (\"vikychoi\" on GitHub)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:57:54.703Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80142"
},
{
"url": "https://go.dev/cl/794100"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"title": "Infinite loop on invalid input in golang.org/x/text"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56852",
"datePublished": "2026-07-21T19:18:59.951Z",
"dateReserved": "2026-06-23T15:10:49.352Z",
"dateUpdated": "2026-08-10T22:57:54.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-56852",
"date": "2026-08-17",
"epss": "0.00446",
"percentile": "0.37061"
},
"microsoft_vex": {
"current_release_date": "2026-08-07T04:19:21.000Z",
"cve": "CVE-2026-56852",
"id": "msrc_CVE-2026-56852",
"initial_release_date": "2026-07-25T01:04:17.000Z",
"product_status:fixed": "40",
"product_status:known_affected": "42",
"product_status:known_not_affected": "4",
"product_status:under_investigation": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Infinite loop on invalid input in golang.org/x/text",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-56852.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-56852\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-07-21T20:17:02.867\",\"lastModified\":\"2026-07-23T18:27:48.877\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"golang.org/x/text\",\"product\":\"golang.org/x/text/unicode/norm\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"golang.org/x/text/unicode/norm\",\"programRoutines\":[{\"name\":\"nextComposed\"},{\"name\":\"Form.Append\"},{\"name\":\"Form.AppendString\"},{\"name\":\"Form.Bytes\"},{\"name\":\"Form.FirstBoundary\"},{\"name\":\"Form.FirstBoundaryInString\"},{\"name\":\"Form.IsNormal\"},{\"name\":\"Form.IsNormalString\"},{\"name\":\"Form.LastBoundary\"},{\"name\":\"Form.NextBoundary\"},{\"name\":\"Form.NextBoundaryInString\"},{\"name\":\"Form.Properties\"},{\"name\":\"Form.PropertiesString\"},{\"name\":\"Form.QuickSpan\"},{\"name\":\"Form.QuickSpanString\"},{\"name\":\"Form.Span\"},{\"name\":\"Form.SpanString\"},{\"name\":\"Form.String\"},{\"name\":\"Form.Transform\"},{\"name\":\"Iter.Init\"},{\"name\":\"Iter.InitString\"},{\"name\":\"Iter.Next\"},{\"name\":\"Iter.Seek\"},{\"name\":\"normReader.Read\"},{\"name\":\"normWriter.Write\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.39.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-23T13:26:14.918983Z\",\"id\":\"CVE-2026-56852\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"references\":[{\"url\":\"https://go.dev/cl/794100\",\"source\":\"security@golang.org\"},{\"url\":\"https://go.dev/issue/80142\",\"source\":\"security@golang.org\"},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-5970\",\"source\":\"security@golang.org\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-17T16:03:58+00:00",
"cve": "CVE-2026-56852",
"id": "CVE-2026-56852",
"initial_release_date": "2026-07-21T19:18:59.951000+00:00",
"product_status:fixed": "102",
"product_status:known_affected": "132",
"product_status:known_not_affected": "21",
"product_status:under_investigation": "57",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56852.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-08-18T00:09:49Z",
"cve": "CVE-2026-56852",
"id": "CVE-2026-56852",
"initial_release_date": "2026-07-19T17:35:30Z",
"product_status:first_fixed": "132",
"product_status:known_affected": "1628",
"product_status:known_not_affected": "394",
"product_status:recommended": "298",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-56852",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-56852.json",
"version": "24"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-56852\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-23T13:26:14.918983Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-23T13:26:06.151Z\"}}], \"cna\": {\"title\": \"Infinite loop on invalid input in golang.org/x/text\", \"credits\": [{\"lang\": \"en\", \"value\": \"Viky Choi (\\\"vikychoi\\\" on GitHub)\"}], \"affected\": [{\"vendor\": \"golang.org/x/text\", \"product\": \"golang.org/x/text/unicode/norm\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.39.0\", \"versionType\": \"semver\"}], \"packageName\": \"golang.org/x/text/unicode/norm\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"nextComposed\"}, {\"name\": \"Form.Append\"}, {\"name\": \"Form.AppendString\"}, {\"name\": \"Form.Bytes\"}, {\"name\": \"Form.FirstBoundary\"}, {\"name\": \"Form.FirstBoundaryInString\"}, {\"name\": \"Form.IsNormal\"}, {\"name\": \"Form.IsNormalString\"}, {\"name\": \"Form.LastBoundary\"}, {\"name\": \"Form.NextBoundary\"}, {\"name\": \"Form.NextBoundaryInString\"}, {\"name\": \"Form.Properties\"}, {\"name\": \"Form.PropertiesString\"}, {\"name\": \"Form.QuickSpan\"}, {\"name\": \"Form.QuickSpanString\"}, {\"name\": \"Form.Span\"}, {\"name\": \"Form.SpanString\"}, {\"name\": \"Form.String\"}, {\"name\": \"Form.Transform\"}, {\"name\": \"Iter.Init\"}, {\"name\": \"Iter.InitString\"}, {\"name\": \"Iter.Next\"}, {\"name\": \"Iter.Seek\"}, {\"name\": \"normReader.Read\"}, {\"name\": \"normWriter.Write\"}]}], \"references\": [{\"url\": \"https://go.dev/issue/80142\"}, {\"url\": \"https://go.dev/cl/794100\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-5970\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-08-10T22:57:54.703Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-56852\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T22:57:54.703Z\", \"dateReserved\": \"2026-06-23T15:10:49.352Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-07-21T19:18:59.951Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:51065
Vulnerability from csaf_redhat - Published: 2026-08-06 11:34 - Updated: 2026-08-17 22:50Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
buildah:
* buildah-1.45.0-2.hum1 (aarch64, x86_64)
* buildah-1.45.0-2.hum1.src (src)
Security Fix(es):
buildah:
* CVE-2026-15788
* CVE-2026-56852
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows (WCOW) configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information disclosure.
6.3 (Medium)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:buildah-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:buildah-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:buildah-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
18 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nbuildah:\n * buildah-1.45.0-2.hum1 (aarch64, x86_64)\n * buildah-1.45.0-2.hum1.src (src)\n\nSecurity Fix(es):\n\nbuildah:\n * CVE-2026-15788\n * CVE-2026-56852",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:51065",
"url": "https://access.redhat.com/errata/RHSA-2026:51065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15788",
"url": "https://access.redhat.com/security/cve/CVE-2026-15788"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51065.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-17T22:50:37+00:00",
"generator": {
"date": "2026-08-17T22:50:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:51065",
"initial_release_date": "2026-08-06T11:34:17+00:00",
"revision_history": [
{
"date": "2026-08-06T11:34:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T22:50:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "buildah-main@aarch64",
"product": {
"name": "buildah-main@aarch64",
"product_id": "buildah-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/buildah@1.45.0-2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "buildah-main@src",
"product": {
"name": "buildah-main@src",
"product_id": "buildah-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/buildah@1.45.0-2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "buildah-main@x86_64",
"product": {
"name": "buildah-main@x86_64",
"product_id": "buildah-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/buildah@1.45.0-2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "buildah-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:buildah-main@aarch64"
},
"product_reference": "buildah-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "buildah-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:buildah-main@src"
},
"product_reference": "buildah-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "buildah-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:buildah-main@x86_64"
},
"product_reference": "buildah-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-15788",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-07-20T20:01:12.124214+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2502989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows (WCOW) configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/buildkit: BuildKit: Information Disclosure via Improper Handling of NTFS Directory Junctions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15788"
},
{
"category": "external",
"summary": "RHBZ#2502989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15788"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15788",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15788"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2"
}
],
"release_date": "2026-07-20T19:12:56.386000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:34:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51065"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/buildkit: BuildKit: Information Disclosure via Improper Handling of NTFS Directory Junctions"
},
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:34:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51065"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:buildah-main@aarch64",
"Red Hat Hardened Images:buildah-main@src",
"Red Hat Hardened Images:buildah-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
}
]
}
RHSA-2026:52912
Vulnerability from csaf_redhat - Published: 2026-08-10 15:02 - Updated: 2026-08-17 16:09Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
skopeo:
* skopeo-1.24.0-2.hum1 (aarch64, x86_64)
* skopeo-tests-1.24.0-2.hum1 (aarch64, x86_64)
* skopeo-1.24.0-2.hum1.src (src)
Security Fix(es):
skopeo:
* CVE-2026-56852
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:skopeo-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:skopeo-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:skopeo-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nskopeo:\n * skopeo-1.24.0-2.hum1 (aarch64, x86_64)\n * skopeo-tests-1.24.0-2.hum1 (aarch64, x86_64)\n * skopeo-1.24.0-2.hum1.src (src)\n\nSecurity Fix(es):\n\nskopeo:\n * CVE-2026-56852",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:52912",
"url": "https://access.redhat.com/errata/RHSA-2026:52912"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52912.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-17T16:09:17+00:00",
"generator": {
"date": "2026-08-17T16:09:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:52912",
"initial_release_date": "2026-08-10T15:02:29+00:00",
"revision_history": [
{
"date": "2026-08-10T15:02:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T16:09:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "skopeo-main@aarch64",
"product": {
"name": "skopeo-main@aarch64",
"product_id": "skopeo-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.24.0-2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "skopeo-main@src",
"product": {
"name": "skopeo-main@src",
"product_id": "skopeo-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.24.0-2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "skopeo-main@x86_64",
"product": {
"name": "skopeo-main@x86_64",
"product_id": "skopeo-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/skopeo@1.24.0-2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:skopeo-main@aarch64"
},
"product_reference": "skopeo-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:skopeo-main@src"
},
"product_reference": "skopeo-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "skopeo-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:skopeo-main@x86_64"
},
"product_reference": "skopeo-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:skopeo-main@aarch64",
"Red Hat Hardened Images:skopeo-main@src",
"Red Hat Hardened Images:skopeo-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-10T15:02:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:skopeo-main@aarch64",
"Red Hat Hardened Images:skopeo-main@src",
"Red Hat Hardened Images:skopeo-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:52912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:skopeo-main@aarch64",
"Red Hat Hardened Images:skopeo-main@src",
"Red Hat Hardened Images:skopeo-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:skopeo-main@aarch64",
"Red Hat Hardened Images:skopeo-main@src",
"Red Hat Hardened Images:skopeo-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
}
]
}
RHSA-2026:54364
Vulnerability from csaf_redhat - Published: 2026-08-12 13:16 - Updated: 2026-08-17 19:31Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
cosign:
* cosign-3.1.2-0.3.hum1 (aarch64, x86_64)
* cosign-3.1.2-0.3.hum1.src (src)
Security Fix(es):
cosign:
* CVE-2026-56852
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:cosign-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:cosign-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:cosign-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ncosign:\n * cosign-3.1.2-0.3.hum1 (aarch64, x86_64)\n * cosign-3.1.2-0.3.hum1.src (src)\n\nSecurity Fix(es):\n\ncosign:\n * CVE-2026-56852",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54364",
"url": "https://access.redhat.com/errata/RHSA-2026:54364"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54364.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-17T19:31:06+00:00",
"generator": {
"date": "2026-08-17T19:31:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:54364",
"initial_release_date": "2026-08-12T13:16:19+00:00",
"revision_history": [
{
"date": "2026-08-12T13:16:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T19:31:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "cosign-main@aarch64",
"product": {
"name": "cosign-main@aarch64",
"product_id": "cosign-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cosign@3.1.2-0.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cosign-main@src",
"product": {
"name": "cosign-main@src",
"product_id": "cosign-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cosign@3.1.2-0.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "cosign-main@x86_64",
"product": {
"name": "cosign-main@x86_64",
"product_id": "cosign-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cosign@3.1.2-0.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cosign-main@aarch64"
},
"product_reference": "cosign-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cosign-main@src"
},
"product_reference": "cosign-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cosign-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cosign-main@x86_64"
},
"product_reference": "cosign-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:cosign-main@aarch64",
"Red Hat Hardened Images:cosign-main@src",
"Red Hat Hardened Images:cosign-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-12T13:16:19+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:cosign-main@aarch64",
"Red Hat Hardened Images:cosign-main@src",
"Red Hat Hardened Images:cosign-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54364"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:cosign-main@aarch64",
"Red Hat Hardened Images:cosign-main@src",
"Red Hat Hardened Images:cosign-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:cosign-main@aarch64",
"Red Hat Hardened Images:cosign-main@src",
"Red Hat Hardened Images:cosign-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
}
]
}
RHSA-2026:54525
Vulnerability from csaf_redhat - Published: 2026-08-13 10:25 - Updated: 2026-08-17 23:41Summary
Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1
Severity
Important
Notes
Topic: external secrets operator for Red Hat OpenShift 1.1.1
Details: The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "external secrets operator for Red Hat OpenShift 1.1.1",
"title": "Topic"
},
{
"category": "general",
"text": "The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54525",
"url": "https://access.redhat.com/errata/RHSA-2026:54525"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44740",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/external-secrets-operator-for-red-hat-openshift",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/external-secrets-operator-for-red-hat-openshift"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54525.json"
}
],
"title": "Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1",
"tracking": {
"current_release_date": "2026-08-17T23:41:48+00:00",
"generator": {
"date": "2026-08-17T23:41:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:54525",
"initial_release_date": "2026-08-13T10:25:25+00:00",
"revision_history": [
{
"date": "2026-08-13T10:25:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T23:41:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "external secrets operator for Red Hat OpenShift 1.1",
"product": {
"name": "external secrets operator for Red Hat OpenShift 1.1",
"product_id": "external secrets operator for Red Hat OpenShift 1.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:external_secrets_operator:1.1::el9"
}
}
}
],
"category": "product_family",
"name": "external secrets operator for Red Hat OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64",
"product": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64",
"product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/external-secrets-rhel9@sha256%3Ad9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9?arch=amd64\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1786614676"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"product": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"product_identification_helper": {
"purl": "pkg:oci/external-secrets-rhel9@sha256%3A534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7?arch=s390x\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1786614676"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"product": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/external-secrets-rhel9@sha256%3A6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332?arch=ppc64le\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1786614676"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"product": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/external-secrets-rhel9@sha256%3A27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a?arch=arm64\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1786614676"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64 as a component of external secrets operator for Red Hat OpenShift 1.1",
"product_id": "external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64"
},
"product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x as a component of external secrets operator for Red Hat OpenShift 1.1",
"product_id": "external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x"
},
"product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le as a component of external secrets operator for Red Hat OpenShift 1.1",
"product_id": "external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le"
},
"product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64 as a component of external secrets operator for Red Hat OpenShift 1.1",
"product_id": "external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
},
"product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64",
"relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T10:25:25+00:00",
"details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54525"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T10:25:25+00:00",
"details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54525"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-44740",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-01T17:01:53.685793+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483894"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "RHBZ#2483894",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
"url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
"url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
"url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
}
],
"release_date": "2026-06-01T16:04:50.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T10:25:25+00:00",
"details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54525"
},
{
"category": "workaround",
"details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
},
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T10:25:25+00:00",
"details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54525"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:27d536de88403ec57239e6fb4c674fd2c5736fefd093df009af4089fb55a682a_arm64",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:534f8dce891c9efd0155ab9408150e5c166ad40f041aaedd80dea623014e66f7_s390x",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6853e928761a2e1980838319fd89592831cda348f3d098fac9aa2873ca4db332_ppc64le",
"external secrets operator for Red Hat OpenShift 1.1:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:d9cb4c7d68769f943bed8b84299e2d4df5ca209cad85bf0ff44ab80e8fe822c9_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
}
]
}
RHSA-2026:54549
Vulnerability from csaf_redhat - Published: 2026-08-13 11:56 - Updated: 2026-08-17 16:09Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
hugo:
* hugo-0.165.0-0.1.hum1 (aarch64, x86_64)
* hugo-0.165.0-0.1.hum1.src (src)
Security Fix(es):
hugo:
* CVE-2026-56852
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:hugo-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:hugo-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nhugo:\n * hugo-0.165.0-0.1.hum1 (aarch64, x86_64)\n * hugo-0.165.0-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\nhugo:\n * CVE-2026-56852",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54549",
"url": "https://access.redhat.com/errata/RHSA-2026:54549"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54549.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-08-17T16:09:18+00:00",
"generator": {
"date": "2026-08-17T16:09:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:54549",
"initial_release_date": "2026-08-13T11:56:05+00:00",
"revision_history": [
{
"date": "2026-08-13T11:56:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T16:09:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-main@aarch64",
"product": {
"name": "hugo-main@aarch64",
"product_id": "hugo-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.165.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-main@src",
"product": {
"name": "hugo-main@src",
"product_id": "hugo-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.165.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-main@x86_64",
"product": {
"name": "hugo-main@x86_64",
"product_id": "hugo-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.165.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-main@aarch64"
},
"product_reference": "hugo-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-main@src"
},
"product_reference": "hugo-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-main@x86_64"
},
"product_reference": "hugo-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T11:56:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54549"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
}
]
}
RHSA-2026:54773
Vulnerability from csaf_redhat - Published: 2026-08-13 20:33 - Updated: 2026-08-17 21:40Summary
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.2 release
Severity
Important
Notes
Topic: Red Hat build of OpenTelemetry 3.10.2 has been released
Details: This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* None
Known issues:
* None
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
7.8 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x | — |
Threats
Impact
Important
A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.
5.3 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 | — |
Vendor Fix
fix
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x | — |
Threats
Impact
Important
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x | — |
Workaround
|
Threats
Impact
Important
References
44 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of OpenTelemetry 3.10.2 has been released",
"title": "Topic"
},
{
"category": "general",
"text": "This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.\n\n\nBreaking changes:\n\n* None\n\n\nDeprecations:\n\n* None\n\n\nTechnology Preview features:\n\n* None\n\n\nEnhancements:\n\n* None\n\n\nBug fixes:\n\n* None\n\n\nKnown issues:\n\n* None",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54773",
"url": "https://access.redhat.com/errata/RHSA-2026:54773"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39822",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41178",
"url": "https://access.redhat.com/security/cve/CVE-2026-41178"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42505",
"url": "https://access.redhat.com/security/cve/CVE-2026-42505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46600",
"url": "https://access.redhat.com/security/cve/CVE-2026-46600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54773.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.2 release",
"tracking": {
"current_release_date": "2026-08-17T21:40:50+00:00",
"generator": {
"date": "2026-08-17T21:40:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:54773",
"initial_release_date": "2026-08-13T20:33:45+00:00",
"revision_history": [
{
"date": "2026-08-13T20:33:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-17T21:40:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift distributed tracing 3.10.1",
"product": {
"name": "Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift distributed tracing"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-operator-bundle@sha256%3Acbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-operator-bundle\u0026tag=1786639770"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1786637598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Ae31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1786635175"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aa471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1786635133"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3Aa151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1786637598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1786635175"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1786635133"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1786637598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1786635175"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1786635133"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1786637598"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Aabef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1786635175"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aa6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1786635133"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x as a component of Red Hat OpenShift distributed tracing 3.10.1",
"product_id": "Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.10.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39822",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-08T17:01:53.592869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: Go os.Root: Symlink following vulnerability allows directory traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "RHBZ#2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://go.dev/cl/797880",
"url": "https://go.dev/cl/797880"
},
{
"category": "external",
"summary": "https://go.dev/issue/79005",
"url": "https://go.dev/issue/79005"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4970",
"url": "https://pkg.go.dev/vuln/GO-2026-4970"
}
],
"release_date": "2026-07-08T15:46:27.199000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T20:33:45+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54773"
},
{
"category": "workaround",
"details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
},
{
"cve": "CVE-2026-41178",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-04T16:01:10.300537+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484830"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41178"
},
{
"category": "external",
"summary": "RHBZ#2484830",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
"url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
}
],
"release_date": "2026-06-04T14:38:23.707000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T20:33:45+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54773"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
},
{
"cve": "CVE-2026-42505",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-08T17:01:05.490547+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package in Go. Handshakes utilizing Encrypted Client Hello (ECH) could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link connections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact information disclosure flaw in the Go `crypto/tls` package allows a passive network observer to de-anonymize connections utilizing Encrypted Client Hello (ECH). The vulnerability stems from the unintentional exposure of pre-shared key identities within the unencrypted client hello, potentially enabling an attacker to link previously anonymous connections. This primarily affects the privacy of communications rather than integrity or availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42505"
},
{
"category": "external",
"summary": "RHBZ#2498138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505"
},
{
"category": "external",
"summary": "https://go.dev/cl/775960",
"url": "https://go.dev/cl/775960"
},
{
"category": "external",
"summary": "https://go.dev/issue/79282",
"url": "https://go.dev/issue/79282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5856",
"url": "https://pkg.go.dev/vuln/GO-2026-5856"
}
],
"release_date": "2026-07-08T15:46:33.407000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T20:33:45+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello"
},
{
"cve": "CVE-2026-46600",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-07-21T20:01:59.038876+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504234"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46600"
},
{
"category": "external",
"summary": "RHBZ#2504234",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504234"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46600"
},
{
"category": "external",
"summary": "https://go.dev/cl/786345",
"url": "https://go.dev/cl/786345"
},
{
"category": "external",
"summary": "https://go.dev/issue/79795",
"url": "https://go.dev/issue/79795"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5942",
"url": "https://pkg.go.dev/vuln/GO-2026-5942"
}
],
"release_date": "2026-07-21T19:18:59.755000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T20:33:45+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54773"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
},
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T20:33:45+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64",
"Red Hat OpenShift distributed tracing 3.10.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
}
]
}
SUSE-SU-2026:3327-1
Vulnerability from csaf_suse - Published: 2026-07-28 09:18 - Updated: 2026-07-28 09:18Summary
Security update for yq
Severity
Important
Notes
Title of the patch: Security update for yq
Description of the patch: This update for yq fixes the following issues:
Update to v4.53.3.
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1267199).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1271994).
Changes for yq:
- v4.53.3:
* Add --ini-preserve-quotes flag for INI round-trip quote preservation.
* Fix: reset INI decoder state on init.
* Fix: decode properties array bracket paths.
* Fix: preserve floats with trailing zero when encoding YAML to JSON.
* Fix: JSON to TOML root scope and null handling.
* Fix: reset TOML decoder finished flag on Init for multi-doc evaluation.
* Fix: reset TOML decoder between files when evaluating all at once.
* Fix: preserve TOML inline table array scope.
* Fix: preserve empty TOML arrays in tables
* Fix: TOML encoder uses inline tables for YAML FlowStyle mappings.
* Fix nested inline YAML merge explode.
* Fix repeatString overflow test on 32-bit platforms.
Patchnames: SUSE-2026-3327,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3327
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for yq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for yq fixes the following issues:\n\nUpdate to v4.53.3.\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1267199).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead\n to infinite loop (bsc#1271994).\n\nChanges for yq:\n\n- v4.53.3:\n * Add --ini-preserve-quotes flag for INI round-trip quote preservation.\n * Fix: reset INI decoder state on init.\n * Fix: decode properties array bracket paths.\n * Fix: preserve floats with trailing zero when encoding YAML to JSON.\n * Fix: JSON to TOML root scope and null handling.\n * Fix: reset TOML decoder finished flag on Init for multi-doc evaluation.\n * Fix: reset TOML decoder between files when evaluating all at once.\n * Fix: preserve TOML inline table array scope.\n * Fix: preserve empty TOML arrays in tables\n * Fix: TOML encoder uses inline tables for YAML FlowStyle mappings.\n * Fix nested inline YAML merge explode.\n * Fix repeatString overflow test on 32-bit platforms.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-3327,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3327",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3327-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:3327-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263327-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:3327-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027991.html"
},
{
"category": "self",
"summary": "SUSE Bug 1267199",
"url": "https://bugzilla.suse.com/1267199"
},
{
"category": "self",
"summary": "SUSE Bug 1271994",
"url": "https://bugzilla.suse.com/1271994"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56852 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56852/"
}
],
"title": "Security update for yq",
"tracking": {
"current_release_date": "2026-07-28T09:18:17Z",
"generator": {
"date": "2026-07-28T09:18:17Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:3327-1",
"initial_release_date": "2026-07-28T09:18:17Z",
"revision_history": [
{
"date": "2026-07-28T09:18:17Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "yq-4.53.3-150500.3.12.1.aarch64",
"product": {
"name": "yq-4.53.3-150500.3.12.1.aarch64",
"product_id": "yq-4.53.3-150500.3.12.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-4.53.3-150500.3.12.1.i586",
"product": {
"name": "yq-4.53.3-150500.3.12.1.i586",
"product_id": "yq-4.53.3-150500.3.12.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-bash-completion-4.53.3-150500.3.12.1.noarch",
"product": {
"name": "yq-bash-completion-4.53.3-150500.3.12.1.noarch",
"product_id": "yq-bash-completion-4.53.3-150500.3.12.1.noarch"
}
},
{
"category": "product_version",
"name": "yq-fish-completion-4.53.3-150500.3.12.1.noarch",
"product": {
"name": "yq-fish-completion-4.53.3-150500.3.12.1.noarch",
"product_id": "yq-fish-completion-4.53.3-150500.3.12.1.noarch"
}
},
{
"category": "product_version",
"name": "yq-zsh-completion-4.53.3-150500.3.12.1.noarch",
"product": {
"name": "yq-zsh-completion-4.53.3-150500.3.12.1.noarch",
"product_id": "yq-zsh-completion-4.53.3-150500.3.12.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-4.53.3-150500.3.12.1.ppc64le",
"product": {
"name": "yq-4.53.3-150500.3.12.1.ppc64le",
"product_id": "yq-4.53.3-150500.3.12.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-4.53.3-150500.3.12.1.s390x",
"product": {
"name": "yq-4.53.3-150500.3.12.1.s390x",
"product_id": "yq-4.53.3-150500.3.12.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-4.53.3-150500.3.12.1.x86_64",
"product": {
"name": "yq-4.53.3-150500.3.12.1.x86_64",
"product_id": "yq-4.53.3-150500.3.12.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-4.53.3-150500.3.12.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64"
},
"product_reference": "yq-4.53.3-150500.3.12.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-4.53.3-150500.3.12.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le"
},
"product_reference": "yq-4.53.3-150500.3.12.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-4.53.3-150500.3.12.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x"
},
"product_reference": "yq-4.53.3-150500.3.12.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-4.53.3-150500.3.12.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
},
"product_reference": "yq-4.53.3-150500.3.12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T09:18:17Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-56852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56852"
}
],
"notes": [
{
"category": "general",
"text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56852",
"url": "https://www.suse.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "SUSE Bug 1271661 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1271661"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.3-150500.3.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T09:18:17Z",
"details": "moderate"
}
],
"title": "CVE-2026-56852"
}
]
}
SUSE-SU-2026:3417-1
Vulnerability from csaf_suse - Published: 2026-07-30 07:06 - Updated: 2026-07-30 07:06Summary
Security update for apptainer
Severity
Important
Notes
Title of the patch: Security update for apptainer
Description of the patch: This update for apptainer fixes the following issues:
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266656).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272115).
Changes for apptainer:
- Update apptainer to version 1.5.3:
* If the ptrace() system call does not work while building an image as
an unprivileged user, skip using PRoot to preserve file ownership and
print an INFO message.
* Bind getopt from the host when using fakeroot command mode, to make
the fakeroot command work with base containers which no longer contain
getopt by default.
* Extended the mksquashfs segmentation fault workaround for cases
where mksquashfs uses many processor cores.
Patchnames: SUSE-2026-3417,SUSE-SLE-Module-HPC-15-SP7-2026-3417,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3417,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3417
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for apptainer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for apptainer fixes the following issues:\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266656).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272115).\n\nChanges for apptainer:\n\n- Update apptainer to version 1.5.3:\n\n * If the ptrace() system call does not work while building an image as\n an unprivileged user, skip using PRoot to preserve file ownership and\n print an INFO message.\n * Bind getopt from the host when using fakeroot command mode, to make\n the fakeroot command work with base containers which no longer contain\n getopt by default.\n * Extended the mksquashfs segmentation fault workaround for cases\n where mksquashfs uses many processor cores.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-3417,SUSE-SLE-Module-HPC-15-SP7-2026-3417,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-3417,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3417",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3417-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:3417-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263417-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:3417-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048961.html"
},
{
"category": "self",
"summary": "SUSE Bug 1266656",
"url": "https://bugzilla.suse.com/1266656"
},
{
"category": "self",
"summary": "SUSE Bug 1272115",
"url": "https://bugzilla.suse.com/1272115"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56852 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56852/"
}
],
"title": "Security update for apptainer",
"tracking": {
"current_release_date": "2026-07-30T07:06:33Z",
"generator": {
"date": "2026-07-30T07:06:33Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:3417-1",
"initial_release_date": "2026-07-30T07:06:33Z",
"revision_history": [
{
"date": "2026-07-30T07:06:33Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "apptainer-1.5.3-150600.4.34.2.aarch64",
"product": {
"name": "apptainer-1.5.3-150600.4.34.2.aarch64",
"product_id": "apptainer-1.5.3-150600.4.34.2.aarch64"
}
},
{
"category": "product_version",
"name": "apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"product": {
"name": "apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"product_id": "apptainer-suid-1.5.3-150600.4.34.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "apptainer-leap-1.5.3-150600.4.34.2.noarch",
"product": {
"name": "apptainer-leap-1.5.3-150600.4.34.2.noarch",
"product_id": "apptainer-leap-1.5.3-150600.4.34.2.noarch"
}
},
{
"category": "product_version",
"name": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"product": {
"name": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"product_id": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
}
},
{
"category": "product_version",
"name": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"product": {
"name": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"product_id": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch"
}
},
{
"category": "product_version",
"name": "apptainer-sle16-1.5.3-150600.4.34.2.noarch",
"product": {
"name": "apptainer-sle16-1.5.3-150600.4.34.2.noarch",
"product_id": "apptainer-sle16-1.5.3-150600.4.34.2.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "apptainer-1.5.3-150600.4.34.2.x86_64",
"product": {
"name": "apptainer-1.5.3-150600.4.34.2.x86_64",
"product_id": "apptainer-1.5.3-150600.4.34.2.x86_64"
}
},
{
"category": "product_version",
"name": "apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"product": {
"name": "apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"product_id": "apptainer-suid-1.5.3-150600.4.34.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for HPC 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise Module for HPC 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-hpc:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP7",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP7",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6",
"product_id": "SUSE Linux Enterprise Server 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for HPC 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for HPC 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch as component of SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch"
},
"product_reference": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for HPC 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.aarch64 as component of SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.x86_64 as component of SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch as component of SUSE Linux Enterprise Module for HPC 15 SP7",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch"
},
"product_reference": "apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-suid-1.5.3-150600.4.34.2.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64"
},
"product_reference": "apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-suid-1.5.3-150600.4.34.2.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64"
},
"product_reference": "apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
},
"product_reference": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.aarch64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-1.5.3-150600.4.34.2.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64"
},
"product_reference": "apptainer-1.5.3-150600.4.34.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
},
"product_reference": "apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-30T07:06:33Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-56852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56852"
}
],
"notes": [
{
"category": "general",
"text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56852",
"url": "https://www.suse.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "SUSE Bug 1271661 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1271661"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for HPC 15 SP7:apptainer-sle15_7-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:apptainer-suid-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6-LTSS:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.aarch64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-1.5.3-150600.4.34.2.x86_64",
"SUSE Linux Enterprise Server 15 SP6:apptainer-sle15_6-1.5.3-150600.4.34.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-30T07:06:33Z",
"details": "moderate"
}
],
"title": "CVE-2026-56852"
}
]
}
SUSE-SU-2026:3439-1
Vulnerability from csaf_suse - Published: 2026-07-31 18:33 - Updated: 2026-07-31 18:33Summary
Security update for google-guest-agent
Severity
Important
Notes
Title of the patch: Security update for google-guest-agent
Description of the patch: This update for google-guest-agent fixes the following issues
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1272118).
Patchnames: SUSE-2026-3439,SUSE-SLE-Module-Public-Cloud-12-2026-3439
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-guest-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-guest-agent fixes the following issues\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266603).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead\n to infinite loop (bsc#1272118).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-3439,SUSE-SLE-Module-Public-Cloud-12-2026-3439",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3439-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:3439-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263439-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:3439-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-August/048985.html"
},
{
"category": "self",
"summary": "SUSE Bug 1266603",
"url": "https://bugzilla.suse.com/1266603"
},
{
"category": "self",
"summary": "SUSE Bug 1272118",
"url": "https://bugzilla.suse.com/1272118"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56852 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56852/"
}
],
"title": "Security update for google-guest-agent",
"tracking": {
"current_release_date": "2026-07-31T18:33:39Z",
"generator": {
"date": "2026-07-31T18:33:39Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:3439-1",
"initial_release_date": "2026-07-31T18:33:39Z",
"revision_history": [
{
"date": "2026-07-31T18:33:39Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-1.66.2.aarch64",
"product": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64",
"product_id": "google-guest-agent-20260529.00-1.66.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-1.66.2.i586",
"product": {
"name": "google-guest-agent-20260529.00-1.66.2.i586",
"product_id": "google-guest-agent-20260529.00-1.66.2.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"product": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"product_id": "google-guest-agent-20260529.00-1.66.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-1.66.2.s390x",
"product": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x",
"product_id": "google-guest-agent-20260529.00-1.66.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-1.66.2.x86_64",
"product": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64",
"product_id": "google-guest-agent-20260529.00-1.66.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12",
"product": {
"name": "SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 12",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-1.66.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-1.66.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-31T18:33:39Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-56852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56852"
}
],
"notes": [
{
"category": "general",
"text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56852",
"url": "https://www.suse.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "SUSE Bug 1271661 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1271661"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server 12:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-guest-agent-20260529.00-1.66.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-guest-agent-20260529.00-1.66.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-31T18:33:39Z",
"details": "moderate"
}
],
"title": "CVE-2026-56852"
}
]
}
SUSE-SU-2026:3496-1
Vulnerability from csaf_suse - Published: 2026-08-04 16:18 - Updated: 2026-08-04 16:18Summary
Security update for google-osconfig-agent
Severity
Moderate
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issue
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1272118).
Patchnames: SUSE-2026-3496,SUSE-SLE-Module-Public-Cloud-12-2026-3496
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.9 (Medium)
Affected products
Recommended
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issue\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead\n to infinite loop (bsc#1272118).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-3496,SUSE-SLE-Module-Public-Cloud-12-2026-3496",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3496-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:3496-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263496-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:3496-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049076.html"
},
{
"category": "self",
"summary": "SUSE Bug 1272118",
"url": "https://bugzilla.suse.com/1272118"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56852 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56852/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2026-08-04T16:18:01Z",
"generator": {
"date": "2026-08-04T16:18:01Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:3496-1",
"initial_release_date": "2026-08-04T16:18:01Z",
"revision_history": [
{
"date": "2026-08-04T16:18:01Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"product": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"product_id": "google-osconfig-agent-20260615.01-1.53.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.53.2.i586",
"product": {
"name": "google-osconfig-agent-20260615.01-1.53.2.i586",
"product_id": "google-osconfig-agent-20260615.01-1.53.2.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"product": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"product_id": "google-osconfig-agent-20260615.01-1.53.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"product": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"product_id": "google-osconfig-agent-20260615.01-1.53.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"product": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"product_id": "google-osconfig-agent-20260615.01-1.53.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12",
"product": {
"name": "SUSE Linux Enterprise Server 12",
"product_id": "SUSE Linux Enterprise Server 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 12",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.53.2.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.53.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56852"
}
],
"notes": [
{
"category": "general",
"text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56852",
"url": "https://www.suse.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "SUSE Bug 1271661 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1271661"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise High Performance Computing 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server 12:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:google-osconfig-agent-20260615.01-1.53.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12:google-osconfig-agent-20260615.01-1.53.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-04T16:18:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-56852"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…