{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Recommended update for dnscrypt-proxy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for dnscrypt-proxy fixes the following issues:\n\nChanges in dnscrypt-proxy:\n\n- Update to version 2.1.16\n  * The \"tls_cipher_suite\" option is now a no-op. Modern TLS stacks no longer\n    expose cipher suite selection in a meaningful way, and the option had become\n    misleading\n  * A log size of 0 no longer means \"unlimited\"; it now correctly disables\n    rotation by size\n  * A new \"tls_prefer_rsa\" option has been added to prefer RSA cipher suites\n    during the TLS handshake, useful on systems without hardware AES\n  * The IP allow/block plugins now support CIDR ranges in addition to single\n    addresses and prefix matching\n  * Forwarding rules now support `$RESOLVCONF:\u003cfile\u003e` to pick up upstream\n    resolvers from a resolv.conf-style file, complementing the existing `$DHCP`\n    syntax\n  * Servers that hit a transient high RTT could previously stay penalized\n    forever and never come back into rotation; their RTT estimate now decays so\n    they can recover\n  * Servers are no longer penalized for slow responses when the response is\n    actually being served from the stale cache\n  * The HTTP transport now handles `Alt-Svc: clear` properly and reuses HTTP\n    connections more aggressively\n  * The cache TTL is now an explicit, configurable parameter rather than being\n    derived implicitly\n  * The \"\"-resolve\"\" command now reports incomplete DNSSEC support instead of\n    silently treating partial signatures as a success\n  * \"jsdelivr is now offered as an alternative source URL for resolver\n    lists, providing more redundancy when the primary mirrors are unreachable\n\n- boo#1260280: vendored google.golang.org/grpc v1.80.0\n- boo#1265785: vendored golang.org/x/net v0.54.0\n\n- Update to version 2.1.15\n  * Proxy hostnames (when using SOCKS/HTTP proxies) are now pre-resolved using\n      bootstrap resolvers if they are domain names\n  * Dynamically reduces timeouts as the connection limit is approached\n  * Fixed double-bracketing of IPv6 addresses in DoH stamps\n  * Cache statistics are now more accurate by only counting queries that\n      actually participate in caching\n  * Multiple IP addresses per hostname are now cached instead of randomly\n      selecting one\n\n- Update to version 2.1.14\n  * Added support for client IP address encryption in logs\n\n- Update to version 2.1.13\n  * Manual configuration reload via SIGHUP is now supported regardless of the\n    hot-reload setting, providing more flexibility for system administrators\n  * Fixed a regression in IP prefix matching for allow/block lists that could\n    cause incorrect filtering behavior\n  * the generate-domains-blocklist script now handles poor network conditions\n    more gracefully\n\n- Update to version 2.1.12\n  * weighted Power of Two (WP2) load balancing strategy has been\n    implemented as the default\n  * optional Prometheus metrics endpoint has been added for monitoring\n  * additional records in queries are now properly removed before forwarding\n  * simple view UI has been removed\n\n- Update to version 2.1.11\n  * web-based monitoring user interface added\n  * configuration files hot-reloading implemented\n  * HTTP/3 probing\n  * added parallel downloading of block lists\n\n- Updated to version 2.1.8\n  * Dependencies have been updated, notably the QUIC implementation, which could\n    be vulnerable to denial-of-service attacks.\n  * In forwarding rules, the target can now optionally include a non-standard\n    DNS port number. The port number is also now optional when using IPv6.\n  * An annoying log message related to permissions on Windows has been\n    suppressed.\n  * Resolver IP addresses can now be refreshed more frequently. Additionally,\n    jitter has been introduced to prevent all resolvers from being refreshed\n    simultaneously. Further changes have been implemented to mitigate issues\n    arising from multiple concurrent attempts to resolve a resolver\u0027s IP\n    address.\n  * An empty value for \"tls_cipher_suite\" is now equivalent to leaving the\n    property undefined. Previously, it disabled all TLS cipher suites, which had\n    little practical justification.\n  * In forwarding rules, an optional `*.` prefix is now accepted.\n\n- Update to version 2.1.7\n  * Reintroduces support for XSalsa20 enryption in DNSCrypt,\n    which was removed in 2.1.6. Unfortunately, a bunch of servers still\n    only support that encryption system.\n  * Added check for lying resolvers was added for DNSCrypt, similar to\n    the one that was already present for DoH and ODoH.\n\n- With vendored quic-go at 0.48.2 since update to 2.1.6\n  boo#1222473 and boo#1235156 should be fixed.\n\n- Update to version 2.1.6\n  * Forwarding: in the list of servers for a zone, the `$BOOTSTRAP`\n    keyword can be included as a shortcut to forward to the bootstrap\n    servers. And the `$DHCP` keyword can be included to forward to the\n    DNS resolvers provided by the local DHCP server. Based on work by YX\n    Hao, thanks! DHCP forwarding should be considered experimental and my\n    not work on all operating systems. A rule for a zone can mix and\n    match multiple forwarder types, such as `10.0.0.1,10.0.0.254,$DHCP,\n    192.168.1.1,$BOOTSTRAP`. Note that this is not implemented for\n    captive portals yet.\n  * Lying resolvers are now skipped, instead of just printing an error.\n    This doesn\u0027t apply to captive portal and forwarding entries, which\n    are the only reasonable use case for lying resolvers.\n  * Support for XSalsa20 in DNSCrypt has been removed. This was not\n    documented, and was supserseded by XChaCha20 in 2016.\n  * Source files are now fetched with compression.\n  * DNS64: compatibility has been improved.\n  * Forwarding: the root domain (`.`) can now be forwarded.\n  * The ARC caching algorithm has been replaced by the SIEVE algorithm.\n  * Properties of multiple servers are now updated simultaneously. The\n    concurrency level can be adjusted with the new\n    `cert_refresh_concurrency` setting. Contributed by YX Hao.\n  * MSI packages for DNSCrypt can now easily be built.\n  * New command-line flag: `-include-relays` to include relays in `-list`\n    and `-list-all`.\n  * Support for DNS extended error codes has been added.\n  * Documentation updates, bug fixes, dependency updates.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-355",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-ru-2026_21160-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1222473",
        "url": "https://bugzilla.suse.com/1222473"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235156",
        "url": "https://bugzilla.suse.com/1235156"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260280",
        "url": "https://bugzilla.suse.com/1260280"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265785",
        "url": "https://bugzilla.suse.com/1265785"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-49295 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-49295/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22189 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22189/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      }
    ],
    "title": "Recommended update for dnscrypt-proxy",
    "tracking": {
      "current_release_date": "2026-09-17T16:49:29Z",
      "generator": {
        "date": "2026-06-25T15:31:46Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-RU-2026:21160-1",
      "initial_release_date": "2026-06-25T15:31:46Z",
      "revision_history": [
        {
          "date": "2026-06-25T15:31:46Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:55:30Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:58:28Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T16:49:29Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
                "product": {
                  "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
                  "product_id": "dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/dnscrypt-proxy@2.1.16-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
                "product": {
                  "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
                  "product_id": "dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/dnscrypt-proxy@2.1.16-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
                "product": {
                  "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
                  "product_id": "dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/dnscrypt-proxy@2.1.16-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64",
                "product": {
                  "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64",
                  "product_id": "dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/dnscrypt-proxy@2.1.16-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64"
        },
        "product_reference": "dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le"
        },
        "product_reference": "dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x"
        },
        "product_reference": "dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
        },
        "product_reference": "dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-49295",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-49295"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer\u0027s RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-49295",
          "url": "https://www.suse.com/security/cve/CVE-2023-49295"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234982 for CVE-2023-49295",
          "url": "https://bugzilla.suse.com/1234982"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T15:31:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-49295"
    },
    {
      "cve": "CVE-2024-22189",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22189"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer\u0027s RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22189",
          "url": "https://www.suse.com/security/cve/CVE-2024-22189"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222461 for CVE-2024-22189",
          "url": "https://bugzilla.suse.com/1222461"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T15:31:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22189"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268676 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1268676"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T15:31:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
          "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268758 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1268758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.s390x",
            "openSUSE Leap 16.0:dnscrypt-proxy-0:2.1.16-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T15:31:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    }
  ]
}