GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:11803-1

Vulnerability from csaf_opensuse - Published: 2026-09-17 00:00 - Updated: 2026-09-18 09:18
Summary
alloy-1.19.2-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: alloy-1.19.2-1.1 on GA media
Description of the patch: These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11803
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-2303
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-37236
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-41178
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-45679
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-45680
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-45681
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-45683
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-45684
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-46600
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-48496
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-56852
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-56854
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact important
CVE-2026-71556
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact important
CVE-2026-71557
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-75889
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact important
CVE-2026-75890
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact not set
CVE-2026-81521
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
CVE-2026-89090
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2026-2303/ self
https://www.suse.com/security/cve/CVE-2026-37236/ self
https://www.suse.com/security/cve/CVE-2026-41178/ self
https://www.suse.com/security/cve/CVE-2026-45679/ self
https://www.suse.com/security/cve/CVE-2026-45680/ self
https://www.suse.com/security/cve/CVE-2026-45681/ self
https://www.suse.com/security/cve/CVE-2026-45683/ self
https://www.suse.com/security/cve/CVE-2026-45684/ self
https://www.suse.com/security/cve/CVE-2026-46600/ self
https://www.suse.com/security/cve/CVE-2026-48496/ self
https://www.suse.com/security/cve/CVE-2026-56852/ self
https://www.suse.com/security/cve/CVE-2026-56854/ self
https://www.suse.com/security/cve/CVE-2026-71556/ self
https://www.suse.com/security/cve/CVE-2026-71557/ self
https://www.suse.com/security/cve/CVE-2026-75889/ self
https://www.suse.com/security/cve/CVE-2026-75890/ self
https://www.suse.com/security/cve/CVE-2026-81521/ self
https://www.suse.com/security/cve/CVE-2026-89090/ self
https://www.suse.com/security/cve/CVE-2026-2303 external
https://bugzilla.suse.com/1268652 external
https://www.suse.com/security/cve/CVE-2026-37236 external
https://bugzilla.suse.com/1277941 external
https://www.suse.com/security/cve/CVE-2026-41178 external
https://bugzilla.suse.com/1276509 external
https://www.suse.com/security/cve/CVE-2026-45679 external
https://bugzilla.suse.com/1267482 external
https://www.suse.com/security/cve/CVE-2026-45680 external
https://bugzilla.suse.com/1267483 external
https://www.suse.com/security/cve/CVE-2026-45681 external
https://bugzilla.suse.com/1267484 external
https://www.suse.com/security/cve/CVE-2026-45683 external
https://bugzilla.suse.com/1267486 external
https://www.suse.com/security/cve/CVE-2026-45684 external
https://bugzilla.suse.com/1267487 external
https://www.suse.com/security/cve/CVE-2026-46600 external
https://bugzilla.suse.com/1272415 external
https://www.suse.com/security/cve/CVE-2026-48496 external
https://bugzilla.suse.com/1268982 external
https://www.suse.com/security/cve/CVE-2026-56852 external
https://bugzilla.suse.com/1271661 external
https://bugzilla.suse.com/1280553 external
https://www.suse.com/security/cve/CVE-2026-56854 external
https://bugzilla.suse.com/1278446 external
https://bugzilla.suse.com/1280553 external
https://www.suse.com/security/cve/CVE-2026-71556 external
https://bugzilla.suse.com/1276977 external
https://www.suse.com/security/cve/CVE-2026-71557 external
https://bugzilla.suse.com/1276986 external
https://www.suse.com/security/cve/CVE-2026-75889 external
https://bugzilla.suse.com/1277429 external
https://www.suse.com/security/cve/CVE-2026-75890 external
https://www.suse.com/security/cve/CVE-2026-81521 external
https://bugzilla.suse.com/1278693 external
https://www.suse.com/security/cve/CVE-2026-89090 external
https://bugzilla.suse.com/1280622 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "alloy-1.19.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11803",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11803-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-2303 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-2303/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-37236 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-37236/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41178 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41178/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45679 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45679/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45680 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45680/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45681 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45681/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45683 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45683/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-45684 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-45684/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46600 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46600/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48496 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48496/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56852 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56852/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56854 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56854/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-71556 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-71556/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-71557 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-71557/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-75889 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-75889/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-75890 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-75890/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-81521 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-81521/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-89090 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-89090/"
      }
    ],
    "title": "alloy-1.19.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-18T09:18:20Z",
      "generator": {
        "date": "2026-09-17T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11803-1",
      "initial_release_date": "2026-09-17T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-17T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-18T09:18:20Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-0:1.19.2-1.1.aarch64",
                "product": {
                  "name": "alloy-0:1.19.2-1.1.aarch64",
                  "product_id": "alloy-0:1.19.2-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/alloy@1.19.2-1.1?arch=aarch64\u0026upstream=alloy-0:1.19.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-0:1.19.2-1.1.ppc64le",
                "product": {
                  "name": "alloy-0:1.19.2-1.1.ppc64le",
                  "product_id": "alloy-0:1.19.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/alloy@1.19.2-1.1?arch=ppc64le\u0026upstream=alloy-0:1.19.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-0:1.19.2-1.1.s390x",
                "product": {
                  "name": "alloy-0:1.19.2-1.1.s390x",
                  "product_id": "alloy-0:1.19.2-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/alloy@1.19.2-1.1?arch=s390x\u0026upstream=alloy-0:1.19.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alloy-0:1.19.2-1.1.x86_64",
                "product": {
                  "name": "alloy-0:1.19.2-1.1.x86_64",
                  "product_id": "alloy-0:1.19.2-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/alloy@1.19.2-1.1?arch=x86_64\u0026upstream=alloy-0:1.19.2-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-0:1.19.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64"
        },
        "product_reference": "alloy-0:1.19.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-0:1.19.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le"
        },
        "product_reference": "alloy-0:1.19.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-0:1.19.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x"
        },
        "product_reference": "alloy-0:1.19.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alloy-0:1.19.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        },
        "product_reference": "alloy-0:1.19.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-2303",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-2303"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The mongo-go-driver repository  contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-2303",
          "url": "https://www.suse.com/security/cve/CVE-2026-2303"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268652 for CVE-2026-2303",
          "url": "https://bugzilla.suse.com/1268652"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-2303"
    },
    {
      "cve": "CVE-2026-37236",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-37236"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-37236",
          "url": "https://www.suse.com/security/cve/CVE-2026-37236"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1277941 for CVE-2026-37236",
          "url": "https://bugzilla.suse.com/1277941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-37236"
    },
    {
      "cve": "CVE-2026-41178",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41178"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41178",
          "url": "https://www.suse.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276509 for CVE-2026-41178",
          "url": "https://bugzilla.suse.com/1276509"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41178"
    },
    {
      "cve": "CVE-2026-45679",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45679"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45679",
          "url": "https://www.suse.com/security/cve/CVE-2026-45679"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267482 for CVE-2026-45679",
          "url": "https://bugzilla.suse.com/1267482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-45679"
    },
    {
      "cve": "CVE-2026-45680",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45680"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45680",
          "url": "https://www.suse.com/security/cve/CVE-2026-45680"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267483 for CVE-2026-45680",
          "url": "https://bugzilla.suse.com/1267483"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-45680"
    },
    {
      "cve": "CVE-2026-45681",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45681"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45681",
          "url": "https://www.suse.com/security/cve/CVE-2026-45681"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267484 for CVE-2026-45681",
          "url": "https://bugzilla.suse.com/1267484"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-45681"
    },
    {
      "cve": "CVE-2026-45683",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45683"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45683",
          "url": "https://www.suse.com/security/cve/CVE-2026-45683"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267486 for CVE-2026-45683",
          "url": "https://bugzilla.suse.com/1267486"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-45683"
    },
    {
      "cve": "CVE-2026-45684",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-45684"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI\u0027s log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-45684",
          "url": "https://www.suse.com/security/cve/CVE-2026-45684"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267487 for CVE-2026-45684",
          "url": "https://bugzilla.suse.com/1267487"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-45684"
    },
    {
      "cve": "CVE-2026-46600",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46600"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46600",
          "url": "https://www.suse.com/security/cve/CVE-2026-46600"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272415 for CVE-2026-46600",
          "url": "https://bugzilla.suse.com/1272415"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-46600"
    },
    {
      "cve": "CVE-2026-48496",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48496"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527  and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622  contains a patch. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48496",
          "url": "https://www.suse.com/security/cve/CVE-2026-48496"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268982 for CVE-2026-48496",
          "url": "https://bugzilla.suse.com/1268982"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48496"
    },
    {
      "cve": "CVE-2026-56852",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56852"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56852",
          "url": "https://www.suse.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271661 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1271661"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56852"
    },
    {
      "cve": "CVE-2026-56854",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56854"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56854",
          "url": "https://www.suse.com/security/cve/CVE-2026-56854"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-56854",
          "url": "https://bugzilla.suse.com/1278446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56854",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56854"
    },
    {
      "cve": "CVE-2026-71556",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-71556"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-71556",
          "url": "https://www.suse.com/security/cve/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276977 for CVE-2026-71556",
          "url": "https://bugzilla.suse.com/1276977"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-71556"
    },
    {
      "cve": "CVE-2026-71557",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-71557"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-71557",
          "url": "https://www.suse.com/security/cve/CVE-2026-71557"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276986 for CVE-2026-71557",
          "url": "https://bugzilla.suse.com/1276986"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-71557"
    },
    {
      "cve": "CVE-2026-75889",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-75889"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Grafana Alloy\u0027s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy\u0027s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy\u0027s service account.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-75889",
          "url": "https://www.suse.com/security/cve/CVE-2026-75889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1277429 for CVE-2026-75889",
          "url": "https://bugzilla.suse.com/1277429"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-75889"
    },
    {
      "cve": "CVE-2026-75890",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-75890"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Duplicate of CVE-2026-50236. This CVE ID was reserved in error for a finding that already had an existing CVE assignment.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-75890",
          "url": "https://www.suse.com/security/cve/CVE-2026-75890"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "not set"
        }
      ],
      "title": "CVE-2026-75890"
    },
    {
      "cve": "CVE-2026-81521",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-81521"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The MongoDB Go Driver\u0027s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-81521",
          "url": "https://www.suse.com/security/cve/CVE-2026-81521"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278693 for CVE-2026-81521",
          "url": "https://bugzilla.suse.com/1278693"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-81521"
    },
    {
      "cve": "CVE-2026-89090",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-89090"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
          "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-89090",
          "url": "https://www.suse.com/security/cve/CVE-2026-89090"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280622 for CVE-2026-89090",
          "url": "https://bugzilla.suse.com/1280622"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.aarch64",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.ppc64le",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.s390x",
            "openSUSE Tumbleweed:alloy-0:1.19.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-89090"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.