{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for google-guest-agent",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for google-guest-agent fixes the following issues:\n\nUpdate to version 20260430.00:\n\n  * Update dependencies and go version to 1.26.2 (#607)\n    (bsc#1265762, CVE-2026-33814)\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n    (bsc#1260264, CVE-2026-33186)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n  * Source the contents of /var/google-users.d config files. (#586)\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n    (bsc#1239334, CVE-2025-22869, bsc#1253889, CVE-2025-58181)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20260424.00\n  * Bring topic-stable up to latest point. (#606)\n  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20260423.01\n  * Update THIRD_PARTY_LICENSES to be package specific location. (#608)\n- from version 20260423.00\n  * Update dependencies and go version to 1.26.2 (#607)\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n  * Source the contents of /var/google-users.d config files. (#586)\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key\n    list is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20260422.01\n  * Bring topic-stable up to latest point. (#606)\n  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20260422.00\n  * Update dependencies and go version to 1.26.2 (#607)\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n  * Source the contents of /var/google-users.d config files. (#586)\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key\n    list is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20260421.00\n  * Bring topic-stable up to latest point. (#606)\n  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20260414.00\n  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)\n- Bump Go API version to 1.26\n\n- CVE-2026-34986: Fixed crafted JWE input with a missing encrypted\n  key can lead to a denial of service (bsc#1262926)\n\n- Update to version 20260402.00: (bsc#1257010)\n\n  * Backport oslogin changes for sles16 to legacy agent (#603)\n  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)\n  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)\n  * Actually finally fix the RPM spec (#601)\n  * Correct guest telemetry build target (#600)\n  * Add packaging for new telemetry extension (#599)\n  * Implement new scheduled job for routes monitor (#598)\n  * Add packaging changes for locally bundled extensions feature support (#593)\n  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)\n  * Disable certificates when security keys are enabled (#588)\n  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)\n\n- Update to version 20260108.00\n  * Source the contents of /var/google-users.d config files. (#586)\n\n- Update to version 20251223.00\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251218.01\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251218.00\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251216.00\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251215.00\n  * Force remove core plugin configuration for windows (#587)\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251210.00\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251209.00\n  * Force remove core plugin configuration for windows (#587)\n\n- Update to version 20251208.00\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list is passed\n    to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251206.00\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251205.00\n  * network: force address manager to always consolidate the OS state (#585)\n  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n\n- Update to version 20251120.01\n  * fix start mode for windows on stable release (#584)\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251120.00\n  * Don\u0027t delete the authorized_keys file when an empty key list\n    is passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251117.00\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251115.00\n  * Don\u0027t delete the authorized_keys file when an empty key list is\n    passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251108.00\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251107.01\n  * Don\u0027t delete the authorized_keys file when an empty key list is\n    passed to updateAuthorizedKeysFile (#582)\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251031.00\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251030.02\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251030.01\n  * Update agent_uninstall.ps1 (#558) (#580)\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251030.00\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251011.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20251009.01\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251009.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n\n- Update to version 20251007.00\n  * Add Tyler, Saswat, Hank to OWNERS (#577)\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251006.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20251006.00\n  * Honor core plugin setting on windows package update (#576)\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20251005.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250930.01\n  * Honor core plugin setting on windows package update (#576)\n- from version 20250929.01\n  * Restart agent if core plugin is disabled (#575)\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250929.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250926.00\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250924.02\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250924.01\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250924.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n\n- Update to version 20250923.01\n  * Add extra debug logging around toggling OS Login (#572)\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250923.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250921.00\n  * Add extra debug logging around toggling OS Login (#572)\n- from version 20250920.01\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250920.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250918.01\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250917.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250917.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250916.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250915.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- Disable missing daemon google_guest_agent_manager referenced by google-startup-scripts.service\n\n- Update to version 20250908.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250907.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250905.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250905.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250902.00\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- Build and install new gce_workload_cert_refresh binary\n- Fix installation source of google_metadata_script_runner_adapt script\n- Install new systemd service file\n  * gce-workload-cert-refresh.service\n\n- Update to version 20250901.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250831.03\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250831.02\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250831.01\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent\n    and disable core plugin (#557)\n- from version 20250831.00\n  * Update go version to 1.25 (#565)\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250830.02\n  * Update go version for stable branch to 1.25 (#571)\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent\n    and disable core plugin (#557)\n- from version 20250830.01\n  * Update go version to 1.25 (#565)\n- from version 20250830.00\n  * Add compat adapt script to windows in agent sysprep (#569)\n  * Fix adapt to use more portable shebang line (#567)\n  * Remove routes script from packaging (#566)\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250828.00\n  * Add adapt script in stable branch as per #569 (#570)\n  * Backport fix from #567 to stable branch (#568)\n- from version 20250826.00\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and\n    disable core plugin (#557)\n- from version 20250821.01\n  * Remove routes script from packaging (#566)\n- Update Go API version to 1.25\n\n- Update to version 20250718.00\n\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n\n- Update to version 20250709.02\n\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n\n- from version 20250709.01\n\n  * Update adapt script to run on startup/shutdown both (#561)\n  * Update agent_uninstall.ps1 (#558)\n  * Stop core plugin before removing agent package (#554)\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n- from version 20250709.00\n  * Revert compat behavior and call known binary directly (#560)\n  * Revert compat behavior and call known binary directly (#559)\n  * Build rollforward package to re-enable original agent and disable core plugin (#557)\n- from version 20250702.00\n  * Update adapt script to run on startup/shutdown both (#561)\n- from version 20250701.01\n  * Update agent_uninstall.ps1 (#558)\n- from version 20250701.00\n  * Stop core plugin before removing agent package (#554)\n- from version 20250628.00\n  * Startup scripts should start after agent manager instead (#553)\n  * Update presets and install dependencies on systemd units (#552)\n  * Ensure agent service is disabled (#551)\n- from version 20250626.00\n  * Disable legacy agent to enable core plugin (#550)\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified files (#520)\" (#523) (#540)\n- from version 20250625.00\n  * prepare stable release.\n- Install google_metadata_script_runner_adapt script (bsc#1245759)\n\n- Update to version 20250624.00\n  * Final fix for RHEL packaging for routes setup (#549)\n  * Fix RHEL packaging for routes scripts (#548)\n  * Packaging changes to include routes script installation (#542)\n  * Update CLI name in packaging (#543)\n  * systemd should manage only the main process (#544)\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified\n    files (#520)\" (#523) (#540)\n- from version 20250611.01\n  * prepare stable release.\n- from version 20250611.00\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified\n    files (#520)\" (#523) (#540)\n- from version 20250609.00\n  * prepare stable release.\n- from version 20250605.00\n  * startup script: wrap compatibility decision into its own scripts (#538)\n  * Reapply \"oslogin: Correctly handle newlines at the end of modified\n    files (#520)\" (#523) (#540)\n  * Make sure agent added connections are activated by NM (#534)\n  * wrap NSS cache refresh in a goroutine (#533)\n  * Wicked: Only reload interfaces for which configurations are\n    written or changed. (#524)\n  * Add AuthorizedKeysCompat to windows packaging (#530)\n  * Remove error messages from gce_workload_cert_refresh and metadata\n    script runner (#527)\n  * Update guest-logging-go dependency (#526)\n  * Add \u0027created-by\u0027 metadata, and pass it as option to logging library (#508)\n  * Revert \"oslogin: Correctly handle newlines at the end of\n    modified files (#520)\" (#523)\n  * Re-enable disabled services if the core plugin was enabled (#522)\n  * Enable guest services on package upgrade (#519)\n  * oslogin: Correctly handle newlines at the end of modified files (#520)\n  * Fix core plugin path (#518)\n  * Fix package build issues (#517)\n  * Fix dependencies ran go mod tidy -v (#515)\n  * Fix debian build path (#514)\n  * Bundle compat metadata script runner binary in package (#513)\n  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)\n  * Update startup/shutdown services to launch compat manager (#503)\n  * Bundle new gce metadata script runner binary in agent package (#502)\n  * Revert \"Revert bundling new binaries in the package (#509)\" (#511)\n\n- Update to version 20250604.00\n  * Preparing stable build.\n- from version 20250602.00\n  * Make sure agent added connections are activated by NM (#534)\n  * wrap NSS cache refresh in a goroutine (#533)\n  * Wicked: Only reload interfaces for which configurations are written or changed. (#524)\n  * Add AuthorizedKeysCompat to windows packaging (#530)\n  * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)\n  * Update guest-logging-go dependency (#526)\n  * Add \u0027created-by\u0027 metadata, and pass it as option to logging library (#508)\n  * Revert \"oslogin: Correctly handle newlines at the end of modified files (#520)\" (#523)\n  * Re-enable disabled services if the core plugin was enabled (#522)\n  * Enable guest services on package upgrade (#519)\n  * oslogin: Correctly handle newlines at the end of modified files (#520)\n  * Fix core plugin path (#518)\n  * Fix package build issues (#517)\n  * Fix dependencies ran go mod tidy -v (#515)\n  * Fix debian build path (#514)\n  * Bundle compat metadata script runner binary in package (#513)\n  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)\n  * Update startup/shutdown services to launch compat manager (#503)\n  * Bundle new gce metadata script runner binary in agent package (#502)\n  * Revert \"Revert bundling new binaries in the package (#509)\" (#511)\n- from version 20250521.00\n  * Preparing stable build.\n- from version 20250515.00\n  * Make sure agent added connections are activated by NM (#534)\n  * wrap NSS cache refresh in a goroutine (#533)\n  * Wicked: Only reload interfaces for which configurations are written or changed. (#524)\n  * Add AuthorizedKeysCompat to windows packaging (#530)\n  * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)\n  * Update guest-logging-go dependency (#526)\n  * Add \u0027created-by\u0027 metadata, and pass it as option to logging library (#508)\n  * Revert \"oslogin: Correctly handle newlines at the end of modified files (#520)\" (#523)\n  * Re-enable disabled services if the core plugin was enabled (#522)\n  * Enable guest services on package upgrade (#519)\n  * oslogin: Correctly handle newlines at the end of modified files (#520)\n  * Fix core plugin path (#518)\n  * Fix package build issues (#517)\n  * Fix dependencies ran go mod tidy -v (#515)\n  * Fix debian build path (#514)\n  * Bundle compat metadata script runner binary in package (#513)\n  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)\n  * Update startup/shutdown services to launch compat manager (#503)\n  * Bundle new gce metadata script runner binary in agent package (#502)\n  * Revert \"Revert bundling new binaries in the package (#509)\" (#511)\n\n- Update to version 20250508.00\n  * Preparing stable build.\n\n- from version 20250506.01 (bsc#1243254, bsc#1243505)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-577",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22133-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22133-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622133-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22133-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026810.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1210938",
        "url": "https://bugzilla.suse.com/1210938"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239334",
        "url": "https://bugzilla.suse.com/1239334"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239944",
        "url": "https://bugzilla.suse.com/1239944"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243254",
        "url": "https://bugzilla.suse.com/1243254"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1243505",
        "url": "https://bugzilla.suse.com/1243505"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1245759",
        "url": "https://bugzilla.suse.com/1245759"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1253889",
        "url": "https://bugzilla.suse.com/1253889"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257010",
        "url": "https://bugzilla.suse.com/1257010"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260264",
        "url": "https://bugzilla.suse.com/1260264"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262926",
        "url": "https://bugzilla.suse.com/1262926"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265762",
        "url": "https://bugzilla.suse.com/1265762"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22869 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      }
    ],
    "title": "Security update for google-guest-agent",
    "tracking": {
      "current_release_date": "2026-06-12T08:44:33Z",
      "generator": {
        "date": "2026-06-12T08:44:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22133-1",
      "initial_release_date": "2026-06-12T08:44:33Z",
      "revision_history": [
        {
          "date": "2026-06-12T08:44:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
                  "product_id": "google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
                "product": {
                  "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
                  "product_id": "google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
                  "product_id": "google-guest-agent-20260430.00-slfo.1.1_1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64",
                  "product_id": "google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le"
        },
        "product_reference": "google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x"
        },
        "product_reference": "google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-12T08:44:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2025-22869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22869",
          "url": "https://www.suse.com/security/cve/CVE-2025-22869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239322 for CVE-2025-22869",
          "url": "https://bugzilla.suse.com/1239322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-12T08:44:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22869"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-12T08:44:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-12T08:44:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-12T08:44:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-guest-agent-20260430.00-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-12T08:44:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for elemental-system-agent",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for elemental-system-agent fixes the following issue\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260277).\n\nChanges for elemental-system-agent:\n\n- Update to version 0.3.16:\n * setup for immutable releases (#274)\n * align system-agent image publishing for signed releases (#270)\n * Bumo github.com/docker/cli to v29.2.0 and go.opentelemetry.io/otel to v1.43.0\n * run go mod tidy in /test folder\n * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (bsc#1260277 CVE-2026-33186)\n * Bump github.com/docker/cli in /test\n * export CATTLE_NODE_NAME if SYSTEM_UPGRADE_NODE_NAME is set\n * use correct prefix for system-agent binary (#273)\n * checksum validation (#271)\n * Add `validate` subcommand for configuration validation (#250)\n * Update CODEOWNERS\n * Pin GH Actions to commit sha\n * chore: bump sles to 15.7\n * Extend remote plan e2e tests\n * Fix agent restart issue and introduce constants\n * chore: bump go to v1.25\n * Setup e2e test infrastructure\n * chores(deps): Bump k8s dependencies\n * Define linter rules\n * Fix CI failures\n * Introduce an extended Makefile\n * Switch workflows to use name makefile\n * Replace dapper with multi stage builds\n * Remove dapper scripts\n * Add multiple improvements for ignore files\n * fix: remove umask command from the system-agent unit-file\n * fix-system-agent-umask\n * [1.34] bumped dependencies for 1.34 support (#242)\n * Bump K8s patch level to 1.33.5 and Go patch level to 1.24.6\n * fix: properly handle traps after unsuccessful SUC job execution\n * fix: do not unconditionally reset failure-counts\n * fix: remove resetFailureCountOnStartup, always reset failure counts on first start\n * un-rc wrangler and lasso\n * drop windows 2019 when running PR CI\n- Update to version 0.3.13:\n * Bumped dependencies for k8s v1.33\n * Add delete for plan.File\n * fix dispatch\n * fix: add retry logic for one time instruction\n * Get UID/GID for current user in write file_test.go\n * Update secrets for dispatch\n * fix golangci\n * support k8s 1.32.2\n * Add GitHub App token generation and dispatch job for System Agent Upgrade workflow.\n * Add ResetFailureCountOnServiceRestart, if true reset plan failure count after each restart of the system-agent\n * Bump wharfie to v0.6.7\n * Add tests and update CI\n * Windows updates\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-574",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22141-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22141-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622141-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22141-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047399.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260277",
        "url": "https://bugzilla.suse.com/1260277"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      }
    ],
    "title": "Security update for elemental-system-agent",
    "tracking": {
      "current_release_date": "2026-06-11T09:43:01Z",
      "generator": {
        "date": "2026-06-11T09:43:01Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22141-1",
      "initial_release_date": "2026-06-11T09:43:01Z",
      "revision_history": [
        {
          "date": "2026-06-11T09:43:01Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64",
                  "product_id": "elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64",
                  "product_id": "elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:elemental-system-agent-0.3.16-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-11T09:43:01Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for google-osconfig-agent",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for google-osconfig-agent fixes the following issues\n\n- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251453).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251704).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260264).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265762).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262926).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent \n  (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264923).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260615.01\n * Upgrade golang.org/x/crypto \u0026 golang.org/x/net (#1006)\n- from version 20260615.00\n * Add unit tests for ospatch_apt_upgrade.go (#938)\n- Update to version 20260611.00\n * Add unit tests for policies/policies.go PART 5 (#998)\n- from version 20260610.00\n * Add unit tests for policies/policies.go PART 4 (#997)\n- from version 20260609.02\n * squash commits (#936)\n- from version 20260609.01\n * Add unit tests for policies/policies.go PART 3 (#996)\n- from version 20260609.00\n * Add unit tests for policies/policies.go PART 2 (#991)\n- from version 20260602.01\n * Align format of dates and timestamp collected across Windows packages (#973)\n- from version 20260602.00\n * Add unit tests for config/config,go (#979)\n- from version 20260528.00\n * Bump github.com/containerd/containerd (#990)\n- from version 20260521.00\n * Cover agentconfig functionality by unit tests (#925)\n- from version 20260520.04\n * Add unit tests for policies/googet.go (#961)\n * Bump github.com/go-git/go-git/v5 (#987)\n- from version 20260520.02\n * Add unit tests for policies/yum.go (#952)\n * Add unit tests for policies/apt.go PART 3 (#951)\n- from version 20260520.00\n * Add unit tests for policies/zypper.go (#953)\n- from version 20260519.00\n * Add unit tests for policies/policies.go PART 1 (#949)\n- from version 20260513.01\n * Bump github.com/go-git/go-git/v5 (#981), this also updates\n golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)\n- from version 20260513.00\n * upgrade a few packages (#980)\n- from version 20260512.02\n * Add/improve unit tests for agentendpoint/exec_task.go (#933)\n- from version 20260512.01\n * Cover google_update.go by unit tests (#941)\n- from version 20260512.00\n * Change zone for arm64 builds because of stockout (#978)\n- Update to version 20260511.00\n * switch to t2a-standard-2 on ARM package build (#977)\n- from version 20260505.03\n * Cover zypper_patch by unit tests (#958)\n- from version 20260505.02\n * Remove unused functions DisableAutoUpdates (#970)\n- from version 20260505.01\n * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)\n- from version 20260505.00\n * Upgrade a few dependencies across the repo (#968)\n + github.com/go-git/go-git/v5 5.16.2-\u003e5.18.0 (bsc#1264923, CVE-2026-41506)\n + github.com/go-jose/go-jose/v4 4.1.3-\u003e4.1.4 (bsc#1262926, CVE-2026-34986)\n + github.com/go-viper/mapstructure/v2 2.3.0-\u003e2.4.0\n + go.opentelemetry.io/otel 1.40.0-\u003e1.41.0\n + go.opentelemetry.io/otel/sdk 1.39.0-\u003e1.43.0\n- from version 20260504.01\n * bump github.com/docker/cli to 29.2.0 (#962)\n- from version 20260504.00\n * Bump github.com/opencontainers/selinux (#960)\n- Update to version 20260428.00\n * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)\n- from version 20260427.03\n * Cover config/file.go by unit tests (#935)\n- from version 20260422.01\n * Cover patch_linux.go by unit tests (#932)\n- from version 20260422.00\n * upgrade grpc package in main package and e2e tests (#959)\n (bsc#1260264, CVE-2026-33186)\n- from version 20260417.04\n * Bump OSV-Scalibr version to v0.4.3 (#956)\n- from version 20260417.03\n * Add unit tests for updates_linux.go (#937)\n- from version 20260417.02\n * Add zone to CreateDisk step (#955)\n- from version 20260417.01\n * Change disk type for deb11 (#954)\n- from version 20260417.00\n * Add unit tests for policies/apt.go PART 1 (#950)\n- from version 20260410.02\n * Add unit tests for packages/pty_linux.go (#943)\n- from version 20260410.01\n * fix disk type for arm workflows (#948)\n- from version 20260410.00\n * Change machine type for arm based workflows (#946)\n- Update to version 20260330.00\n * bump timeouts for all workflows (#940)\n- from version 20260326.00\n * Cover exec_resource.go by unit tests (#934)\n- from version 20260318.00\n * Integrate OSConfig agent with ReportVmInventory (#923)\n- from version 20260313.02\n * remove cacheonly flag from yum upgrade (#924)\n- from version 20260313.01\n * conditions python version override (#927)\n- from version 20260313.00\n * Fix presubmits by explicitly set python version for rpm based systems (#926)\n- from version 20260311.00\n * Bump osconfig version (#922)\n- from version 20260309.02\n * Extend OSV scalibr extractor (#921)\n- from version 20260309.01\n * upgrade golang.org/x/crypto and it\u0027s transitive deps (#918)\n- from version 20260309.00\n * Add purl to pkg info (#920)\n- from version 20260306.00\n * Add \u0027Type\u0027 field to PkgInfo (#919)\n- from version 20260303.01\n * Upgrade go.opentelemetry.io/otel/sdk (#913)\n- from version 20260303.00\n * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)\n- from version 20260302.00\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)\n- from version 20260126.00\n * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)\n * Bump github.com/sirupsen/logrus (#894)\n- Update to version 20260119.00\n * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)\n- Update to version 20251230.00\n * chore: Migrate gsutil usage to gcloud storage (#904)\n- from version 20251223.00\n * fix e2e tests for report inventory (#903)\n- from version 20251222.01\n * Revert \"Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\" (#902)\n- from version 20251222.00\n * Bump golang to the new version (#900)\n- from version 20251218.00\n * add new CODEOWNERS (#901)\n- from version 20251217.00\n * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\n- Bump the golang compiler version to 1.24.5\n- Update to version 20251202.00\n * Revert \"Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\" (#893)\n- Update to version 20251201.00\n * Revert \"Bump github.com/containerd/containerd (#890)\" (#892)\n- Update to version 20251126.00\n * Bump github.com/containerd/containerd (#890)\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\n- Update to version 20251028.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)\n * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)\n- from version 20251023.02\n * Create multiple_os.yaml (#883)\n- from version 20251023.00\n * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)\n * Add test runner for e2e tests (#876)\n- Update to version 20250925.00\n * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)\n * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)\n * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)\n * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)\n- Update to version 20250902.01\n * Bump github.com/googleapis/enterprise-certificate-proxy (#829)\n- from version 20250902.00\n * update github.com/go-jose/go-jose/v4 (#869)\n * Upgrade scalibr and other deps (#866)\n- from version 20250901.00\n * Fix possibility of path traversal for zip and tar archival (#868)\n- from version 20250825.00\n * set CODEOWNERS file as required by org (#863)\n- from version 20250819.00\n * Fix/rhel10 build centos image (#860)\n- from version 20250814.00\n * Fix/rhel10 build image (#859)\n- from version 20250813.00\n * Fix: Add RHEL 10 support to RPM startup script (#858)\n- from version 20250811.00\n * Remove old/sles-15-sp4-sap as image is deprecated (#857)\n- Update to version 20250806.00\n * Fixed JSON identifier for the universe domain (#855)\n- from version 20250729.00\n * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)\n- from version 20250725.02\n * Update utils.go (#854)\n * Upgrade golang.org/x/oauth2 package to the latest. (#853)\n * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)\n- from version 20250725.01\n * Bump golang.org/x/oauth2 (#848)\n * Port fix for debian 11 to goo package manager. (#852)\n- from version 20250725.00\n * Update Golang version in common.sh and skip backports\n repo for debian 11 (#850)\n- from version 20250723.01\n * Add workflows to build package for el10 (#849)\n- from version 20250721.00\n * Make OS Config agent TPC aware (#846)\n- from version 20250718.00\n * Create workflows for new Debian 13. (#847)\n- Update to version 20250703.00\n * Fix sles images (#844)\n- from version 20250702.00\n * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)\n- from version 20250701.00\n * Bump the go_modules group across 1 directory with 2 updates (#840)\n- Update to version 20250606.00\n * Change base docker images Google\u0027s official base images. (#838)\n- Update to version 20250523.01\n * Add a simple no-op OS policy for user testing (#837)\n- from version 20250523.00\n * Introduce scalibr inventory extractor for dpkg/rpm/cos\n os/filesystem extractors (linux) (#834)\n * Trace GetInstalledPackages memory levels (#835)\n- from version 20250520.00\n- Update to version 20250513.00\n * Fix rpm extractor, handle (none) value correctly. (#833)\n- from version 20250512.01\n * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)\n- from version 20250512.00\n * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)\n- from version 20250508.01\n * cosmetic refactoring to osinfo package (#826)\n- from version 20250508.00\n * Refactor /inventory with dependency injection (#825)\n * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)\n * cover packages_linux.go file with tests (#824)\n * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)\n- from version 20250507.00\n * Add InstalledRPMPackages snapshot tests (#823)\n- from version 20250506.02\n * Yum tests: simplify initialization of exit errors (#820)\n- from version 20250506.01\n * Improve test coverage for gem package manager (#818)\n- from version 20250506.00\n * after go/x/crypto update 0.32.0 -\u003e 0.37.0 (#817)\n- from version 20250505.01\n * Improve packages package coverage (#814)\n * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)\n- from version 20250505.00\n * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)\n- from version 20250430.00\n * Snapshot YumUpdates (GetPackageUpdates) output (#813)\n- from version 20250428.00\n * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output\n for sles 12, 15 testdata (#812)\n- from version 20250423.00\n * Introduce MatchSnapshot large test results matcher function, snapshot\n apt-deb GetPackageUpdates (#811)\n- from version 20250416.02\n * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)\n * Add output of some packagemanagers to the testdata (#808)\n- from version 20250416.01\n * Refactor OS Info package (#809)\n- from version 20250416.00\n * Report RPM inventory as YUM instead of empty SoftwarePackage\n when neither Zypper nor YUM are installed. (#805)\n- from version 20250414.00\n * Update hash computation algorithm (#799)\n- Update to version 20250320.00\n * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)\n- from version 20250318.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)\n- from version 20250317.02\n * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)\n * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)\n- from version 20250317.01\n * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)\n- from version 20250317.00\n * Add tests for retryutil package. (#795)\n- from version 20250306.00\n * Update OWNERS (#794)\n- from version 20250206.01\n * Use separate counters for pre- and post-patch reboots. (#788)\n- from version 20250206.00\n * Update owners (#789)\n- from version 20250203.00\n * Fix the vet errors for contants in logging (#786)\n- from version 20250122.00\n * change available package check (#783)\n- from version 20250121.00\n * Fix Inventory reporting e2e tests. (#782)\n- from version 20250120.00\n * fix e2e tests (#781)\n- Add -buildmode=pie to go build command line (bsc#1239948)\n- from version 20240501.00 (bsc#1236533, CVE-2023-45288)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-764",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22242-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22242-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622242-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22242-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047622.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1210938",
        "url": "https://bugzilla.suse.com/1210938"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236533",
        "url": "https://bugzilla.suse.com/1236533"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239948",
        "url": "https://bugzilla.suse.com/1239948"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1244304",
        "url": "https://bugzilla.suse.com/1244304"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1244503",
        "url": "https://bugzilla.suse.com/1244503"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251453",
        "url": "https://bugzilla.suse.com/1251453"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251704",
        "url": "https://bugzilla.suse.com/1251704"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260264",
        "url": "https://bugzilla.suse.com/1260264"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262926",
        "url": "https://bugzilla.suse.com/1262926"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1264923",
        "url": "https://bugzilla.suse.com/1264923"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265762",
        "url": "https://bugzilla.suse.com/1265762"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266171",
        "url": "https://bugzilla.suse.com/1266171"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266603",
        "url": "https://bugzilla.suse.com/1266603"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39827 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39828 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39828/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39829 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39829/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39830 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39830/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39831 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39831/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39832 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39833 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39833/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39834 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39834/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39835 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39835/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42508 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42508/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46595 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46595/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46597 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46597/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46598 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46598/"
      }
    ],
    "title": "Security update for google-osconfig-agent",
    "tracking": {
      "current_release_date": "2026-06-22T09:09:04Z",
      "generator": {
        "date": "2026-06-22T09:09:04Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22242-1",
      "initial_release_date": "2026-06-22T09:09:04Z",
      "revision_history": [
        {
          "date": "2026-06-22T09:09:04Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-1.1.aarch64",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-1.1.aarch64",
                  "product_id": "google-osconfig-agent-20260615.01-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-1.1.s390x",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-1.1.s390x",
                  "product_id": "google-osconfig-agent-20260615.01-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-1.1.x86_64",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-1.1.x86_64",
                  "product_id": "google-osconfig-agent-20260615.01-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64"
        },
        "product_reference": "google-osconfig-agent-20260615.01-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x"
        },
        "product_reference": "google-osconfig-agent-20260615.01-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        },
        "product_reference": "google-osconfig-agent-20260615.01-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    },
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268676 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1268676"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268758 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1268758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-39827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39827",
          "url": "https://www.suse.com/security/cve/CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39827",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39827"
    },
    {
      "cve": "CVE-2026-39828",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39828"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39828",
          "url": "https://www.suse.com/security/cve/CVE-2026-39828"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39828",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39828"
    },
    {
      "cve": "CVE-2026-39829",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39829"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39829",
          "url": "https://www.suse.com/security/cve/CVE-2026-39829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39829",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39829"
    },
    {
      "cve": "CVE-2026-39830",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39830"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39830",
          "url": "https://www.suse.com/security/cve/CVE-2026-39830"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39830",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39830"
    },
    {
      "cve": "CVE-2026-39831",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39831"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39831",
          "url": "https://www.suse.com/security/cve/CVE-2026-39831"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39831",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39831"
    },
    {
      "cve": "CVE-2026-39832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39832",
          "url": "https://www.suse.com/security/cve/CVE-2026-39832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39832",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39832"
    },
    {
      "cve": "CVE-2026-39833",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39833"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39833",
          "url": "https://www.suse.com/security/cve/CVE-2026-39833"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39833",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39833"
    },
    {
      "cve": "CVE-2026-39834",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39834"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39834",
          "url": "https://www.suse.com/security/cve/CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39834",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39834"
    },
    {
      "cve": "CVE-2026-39835",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39835"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39835",
          "url": "https://www.suse.com/security/cve/CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39835",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39835"
    },
    {
      "cve": "CVE-2026-41506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41506",
          "url": "https://www.suse.com/security/cve/CVE-2026-41506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264854 for CVE-2026-41506",
          "url": "https://bugzilla.suse.com/1264854"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41506"
    },
    {
      "cve": "CVE-2026-42508",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42508"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42508",
          "url": "https://www.suse.com/security/cve/CVE-2026-42508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-42508",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42508"
    },
    {
      "cve": "CVE-2026-46595",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46595"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46595",
          "url": "https://www.suse.com/security/cve/CVE-2026-46595"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46595",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46595"
    },
    {
      "cve": "CVE-2026-46597",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46597"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46597",
          "url": "https://www.suse.com/security/cve/CVE-2026-46597"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46597",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46597"
    },
    {
      "cve": "CVE-2026-46598",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46598"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
          "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46598",
          "url": "https://www.suse.com/security/cve/CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46598",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
            "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:09:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46598"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for google-osconfig-agent",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for google-osconfig-agent fixes the following issues\n\n- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251453).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251704).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260264).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265762).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262926).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264923).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260615.01\n * Upgrade golang.org/x/crypto \u0026 golang.org/x/net (#1006)\n- from version 20260615.00\n * Add unit tests for ospatch_apt_upgrade.go (#938)\n- Update to version 20260611.00\n * Add unit tests for policies/policies.go PART 5 (#998)\n- from version 20260610.00\n * Add unit tests for policies/policies.go PART 4 (#997)\n- from version 20260609.02\n * squash commits (#936)\n- from version 20260609.01\n * Add unit tests for policies/policies.go PART 3 (#996)\n- from version 20260609.00\n * Add unit tests for policies/policies.go PART 2 (#991)\n- from version 20260602.01\n * Align format of dates and timestamp collected across Windows packages (#973)\n- from version 20260602.00\n * Add unit tests for config/config,go (#979)\n- from version 20260528.00\n * Bump github.com/containerd/containerd (#990)\n- from version 20260521.00\n * Cover agentconfig functionality by unit tests (#925)\n- from version 20260520.04\n * Add unit tests for policies/googet.go (#961)\n * Bump github.com/go-git/go-git/v5 (#987)\n- from version 20260520.02\n * Add unit tests for policies/yum.go (#952)\n * Add unit tests for policies/apt.go PART 3 (#951)\n- from version 20260520.00\n * Add unit tests for policies/zypper.go (#953)\n- from version 20260519.00\n * Add unit tests for policies/policies.go PART 1 (#949)\n- from version 20260513.01\n * Bump github.com/go-git/go-git/v5 (#981), this also updates\n golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)\n- from version 20260513.00\n * upgrade a few packages (#980)\n- from version 20260512.02\n * Add/improve unit tests for agentendpoint/exec_task.go (#933)\n- from version 20260512.01\n * Cover google_update.go by unit tests (#941)\n- from version 20260512.00\n * Change zone for arm64 builds because of stockout (#978)\n- Update to version 20260511.00\n * switch to t2a-standard-2 on ARM package build (#977)\n- from version 20260505.03\n * Cover zypper_patch by unit tests (#958)\n- from version 20260505.02\n * Remove unused functions DisableAutoUpdates (#970)\n- from version 20260505.01\n * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)\n- from version 20260505.00\n * Upgrade a few dependencies across the repo (#968)\n + github.com/go-git/go-git/v5 5.16.2-\u003e5.18.0 (bsc#1264923, CVE-2026-41506)\n + github.com/go-jose/go-jose/v4 4.1.3-\u003e4.1.4 (bsc#1262926, CVE-2026-34986)\n + github.com/go-viper/mapstructure/v2 2.3.0-\u003e2.4.0\n + go.opentelemetry.io/otel 1.40.0-\u003e1.41.0\n + go.opentelemetry.io/otel/sdk 1.39.0-\u003e1.43.0\n- from version 20260504.01\n * bump github.com/docker/cli to 29.2.0 (#962)\n- from version 20260504.00\n * Bump github.com/opencontainers/selinux (#960)\n- Update to version 20260428.00\n * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)\n- from version 20260427.03\n * Cover config/file.go by unit tests (#935)\n- from version 20260422.01\n * Cover patch_linux.go by unit tests (#932)\n- from version 20260422.00\n * upgrade grpc package in main package and e2e tests (#959)\n (bsc#1260264, CVE-2026-33186)\n- from version 20260417.04\n * Bump OSV-Scalibr version to v0.4.3 (#956)\n- from version 20260417.03\n * Add unit tests for updates_linux.go (#937)\n- from version 20260417.02\n * Add zone to CreateDisk step (#955)\n- from version 20260417.01\n * Change disk type for deb11 (#954)\n- from version 20260417.00\n * Add unit tests for policies/apt.go PART 1 (#950)\n- from version 20260410.02\n * Add unit tests for packages/pty_linux.go (#943)\n- from version 20260410.01\n * fix disk type for arm workflows (#948)\n- from version 20260410.00\n * Change machine type for arm based workflows (#946)\n- Update to version 20260330.00\n * bump timeouts for all workflows (#940)\n- from version 20260326.00\n * Cover exec_resource.go by unit tests (#934)\n- from version 20260318.00\n * Integrate OSConfig agent with ReportVmInventory (#923)\n- from version 20260313.02\n * remove cacheonly flag from yum upgrade (#924)\n- from version 20260313.01\n * conditions python version override (#927)\n- from version 20260313.00\n * Fix presubmits by explicitly set python version for rpm based systems (#926)\n- from version 20260311.00\n * Bump osconfig version (#922)\n- from version 20260309.02\n * Extend OSV scalibr extractor (#921)\n- from version 20260309.01\n * upgrade golang.org/x/crypto and it\u0027s transitive deps (#918)\n- from version 20260309.00\n * Add purl to pkg info (#920)\n- from version 20260306.00\n * Add \u0027Type\u0027 field to PkgInfo (#919)\n- from version 20260303.01\n * Upgrade go.opentelemetry.io/otel/sdk (#913)\n- from version 20260303.00\n * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)\n- from version 20260302.00\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)\n- from version 20260126.00\n * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)\n * Bump github.com/sirupsen/logrus (#894)\n- Update to version 20260119.00\n * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)\n- Update to version 20251230.00\n * chore: Migrate gsutil usage to gcloud storage (#904)\n- from version 20251223.00\n * fix e2e tests for report inventory (#903)\n- from version 20251222.01\n * Revert \"Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\" (#902)\n- from version 20251222.00\n * Bump golang to the new version (#900)\n- from version 20251218.00\n * add new CODEOWNERS (#901)\n- from version 20251217.00\n * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\n- Bump the golang compiler version to 1.24.5\n- Update to version 20251202.00\n * Revert \"Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\" (#893)\n- Update to version 20251201.00\n * Revert \"Bump github.com/containerd/containerd (#890)\" (#892)\n- Update to version 20251126.00\n * Bump github.com/containerd/containerd (#890)\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\n- Update to version 20251028.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)\n * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)\n- from version 20251023.02\n * Create multiple_os.yaml (#883)\n- from version 20251023.00\n * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)\n * Add test runner for e2e tests (#876)\n- Update to version 20250925.00\n * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)\n * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)\n * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)\n * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)\n- Update to version 20250902.01\n * Bump github.com/googleapis/enterprise-certificate-proxy (#829)\n- from version 20250902.00\n * update github.com/go-jose/go-jose/v4 (#869)\n * Upgrade scalibr and other deps (#866)\n- from version 20250901.00\n * Fix possibility of path traversal for zip and tar archival (#868)\n- from version 20250825.00\n * set CODEOWNERS file as required by org (#863)\n- from version 20250819.00\n * Fix/rhel10 build centos image (#860)\n- from version 20250814.00\n * Fix/rhel10 build image (#859)\n- from version 20250813.00\n * Fix: Add RHEL 10 support to RPM startup script (#858)\n- from version 20250811.00\n * Remove old/sles-15-sp4-sap as image is deprecated (#857)\n- Update to version 20250806.00\n * Fixed JSON identifier for the universe domain (#855)\n- from version 20250729.00\n * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)\n- from version 20250725.02\n * Update utils.go (#854)\n * Upgrade golang.org/x/oauth2 package to the latest. (#853)\n * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)\n- from version 20250725.01\n * Bump golang.org/x/oauth2 (#848)\n * Port fix for debian 11 to goo package manager. (#852)\n- from version 20250725.00\n * Update Golang version in common.sh and skip backports\n repo for debian 11 (#850)\n- from version 20250723.01\n * Add workflows to build package for el10 (#849)\n- from version 20250721.00\n * Make OS Config agent TPC aware (#846)\n- from version 20250718.00\n * Create workflows for new Debian 13. (#847)\n- Update to version 20250703.00\n * Fix sles images (#844)\n- from version 20250702.00\n * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)\n- from version 20250701.00\n * Bump the go_modules group across 1 directory with 2 updates (#840)\n- Update to version 20250606.00\n * Change base docker images Google\u0027s official base images. (#838)\n- Update to version 20250523.01\n * Add a simple no-op OS policy for user testing (#837)\n- from version 20250523.00\n * Introduce scalibr inventory extractor for dpkg/rpm/cos\n os/filesystem extractors (linux) (#834)\n * Trace GetInstalledPackages memory levels (#835)\n- from version 20250520.00\n- Update to version 20250513.00\n * Fix rpm extractor, handle (none) value correctly. (#833)\n- from version 20250512.01\n * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)\n- from version 20250512.00\n * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)\n- from version 20250508.01\n * cosmetic refactoring to osinfo package (#826)\n- from version 20250508.00\n * Refactor /inventory with dependency injection (#825)\n * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)\n * cover packages_linux.go file with tests (#824)\n * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)\n- from version 20250507.00\n * Add InstalledRPMPackages snapshot tests (#823)\n- from version 20250506.02\n * Yum tests: simplify initialization of exit errors (#820)\n- from version 20250506.01\n * Improve test coverage for gem package manager (#818)\n- from version 20250506.00\n * after go/x/crypto update 0.32.0 -\u003e 0.37.0 (#817)\n- from version 20250505.01\n * Improve packages package coverage (#814)\n * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)\n- from version 20250505.00\n * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)\n- from version 20250430.00\n * Snapshot YumUpdates (GetPackageUpdates) output (#813)\n- from version 20250428.00\n * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output\n for sles 12, 15 testdata (#812)\n- from version 20250423.00\n * Introduce MatchSnapshot large test results matcher function, snapshot\n apt-deb GetPackageUpdates (#811)\n- from version 20250416.02\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-587",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22249-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22249-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622249-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22249-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047615.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1210938",
        "url": "https://bugzilla.suse.com/1210938"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251453",
        "url": "https://bugzilla.suse.com/1251453"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251704",
        "url": "https://bugzilla.suse.com/1251704"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260264",
        "url": "https://bugzilla.suse.com/1260264"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262926",
        "url": "https://bugzilla.suse.com/1262926"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1264923",
        "url": "https://bugzilla.suse.com/1264923"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265762",
        "url": "https://bugzilla.suse.com/1265762"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266171",
        "url": "https://bugzilla.suse.com/1266171"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266603",
        "url": "https://bugzilla.suse.com/1266603"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39827 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39828 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39828/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39829 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39829/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39830 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39830/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39831 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39831/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39832 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39833 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39833/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39834 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39834/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39835 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39835/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42508 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42508/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46595 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46595/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46597 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46597/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46598 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46598/"
      }
    ],
    "title": "Security update for google-osconfig-agent",
    "tracking": {
      "current_release_date": "2026-06-22T09:04:46Z",
      "generator": {
        "date": "2026-06-22T09:04:46Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22249-1",
      "initial_release_date": "2026-06-22T09:04:46Z",
      "revision_history": [
        {
          "date": "2026-06-22T09:04:46Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
                  "product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
                  "product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
                  "product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64",
                  "product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le"
        },
        "product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x"
        },
        "product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268676 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1268676"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268758 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1268758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-39827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39827",
          "url": "https://www.suse.com/security/cve/CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39827",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39827"
    },
    {
      "cve": "CVE-2026-39828",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39828"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39828",
          "url": "https://www.suse.com/security/cve/CVE-2026-39828"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39828",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39828"
    },
    {
      "cve": "CVE-2026-39829",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39829"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39829",
          "url": "https://www.suse.com/security/cve/CVE-2026-39829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39829",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39829"
    },
    {
      "cve": "CVE-2026-39830",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39830"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39830",
          "url": "https://www.suse.com/security/cve/CVE-2026-39830"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39830",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39830"
    },
    {
      "cve": "CVE-2026-39831",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39831"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39831",
          "url": "https://www.suse.com/security/cve/CVE-2026-39831"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39831",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39831"
    },
    {
      "cve": "CVE-2026-39832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39832",
          "url": "https://www.suse.com/security/cve/CVE-2026-39832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39832",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39832"
    },
    {
      "cve": "CVE-2026-39833",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39833"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39833",
          "url": "https://www.suse.com/security/cve/CVE-2026-39833"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39833",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39833"
    },
    {
      "cve": "CVE-2026-39834",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39834"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39834",
          "url": "https://www.suse.com/security/cve/CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39834",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39834"
    },
    {
      "cve": "CVE-2026-39835",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39835"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39835",
          "url": "https://www.suse.com/security/cve/CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39835",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39835"
    },
    {
      "cve": "CVE-2026-41506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41506",
          "url": "https://www.suse.com/security/cve/CVE-2026-41506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264854 for CVE-2026-41506",
          "url": "https://bugzilla.suse.com/1264854"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41506"
    },
    {
      "cve": "CVE-2026-42508",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42508"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42508",
          "url": "https://www.suse.com/security/cve/CVE-2026-42508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-42508",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42508"
    },
    {
      "cve": "CVE-2026-46595",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46595"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46595",
          "url": "https://www.suse.com/security/cve/CVE-2026-46595"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46595",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46595"
    },
    {
      "cve": "CVE-2026-46597",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46597"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46597",
          "url": "https://www.suse.com/security/cve/CVE-2026-46597"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46597",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46597"
    },
    {
      "cve": "CVE-2026-46598",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46598"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46598",
          "url": "https://www.suse.com/security/cve/CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46598",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-22T09:04:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46598"
    }
  ]
}