OPENSUSE-SU-2026:21367-1

Vulnerability from csaf_opensuse - Published: 2026-07-17 12:53 - Updated: 2026-07-17 12:53
Summary
Security update for lux
Severity
Important
Notes
Title of the patch: Security update for lux
Description of the patch: This update for lux fixes the following issues: Changes in lux: - CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Issues when parsing HTML files (bsc#1267110) - CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content (bsc#1235304) - CVE-2025-22872: Incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241766) - CVE-2025-47911: Various algorithms with quadratic complexity when parsing HTML documents (bsc#1251460) - CVE-2025-58190: Excessive memory consumption (bsc#1251627) Bump x/net to 0.57.0 - Update to 0.24.1: * ci: bump go version to 1.22 #1350
Patchnames: openSUSE-Leap-16.0-packagehub-427
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2024-45338
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2025-22872
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2025-47911
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2025-58190
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-25680
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-25681
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-27136
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-42502
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-42506
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://bugzilla.suse.com/1235304 self
https://bugzilla.suse.com/1241766 self
https://bugzilla.suse.com/1251460 self
https://bugzilla.suse.com/1251627 self
https://bugzilla.suse.com/1267110 self
https://www.suse.com/security/cve/CVE-2024-45338/ self
https://www.suse.com/security/cve/CVE-2025-22872/ self
https://www.suse.com/security/cve/CVE-2025-47911/ self
https://www.suse.com/security/cve/CVE-2025-58190/ self
https://www.suse.com/security/cve/CVE-2026-25680/ self
https://www.suse.com/security/cve/CVE-2026-25681/ self
https://www.suse.com/security/cve/CVE-2026-27136/ self
https://www.suse.com/security/cve/CVE-2026-42502/ self
https://www.suse.com/security/cve/CVE-2026-42506/ self
https://www.suse.com/security/cve/CVE-2024-45338 external
https://bugzilla.suse.com/1234794 external
https://www.suse.com/security/cve/CVE-2025-22872 external
https://bugzilla.suse.com/1241710 external
https://bugzilla.suse.com/1265255 external
https://bugzilla.suse.com/1265256 external
https://bugzilla.suse.com/1265259 external
https://www.suse.com/security/cve/CVE-2025-47911 external
https://bugzilla.suse.com/1251308 external
https://www.suse.com/security/cve/CVE-2025-58190 external
https://bugzilla.suse.com/1251309 external
https://www.suse.com/security/cve/CVE-2026-25680 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-25681 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-27136 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-42502 external
https://bugzilla.suse.com/1267044 external
https://www.suse.com/security/cve/CVE-2026-42506 external
https://bugzilla.suse.com/1267044 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for lux",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for lux fixes the following issues:\n\nChanges in lux:\n\n- CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506:\n  Issues when parsing HTML files (bsc#1267110)\n- CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content (bsc#1235304)\n- CVE-2025-22872: Incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241766)\n- CVE-2025-47911: Various algorithms with quadratic complexity when parsing HTML documents (bsc#1251460)\n- CVE-2025-58190: Excessive memory consumption (bsc#1251627)\n  Bump x/net to 0.57.0\n\n- Update to 0.24.1:\n  * ci: bump go version to 1.22 #1350\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-427",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21367-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235304",
        "url": "https://bugzilla.suse.com/1235304"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241766",
        "url": "https://bugzilla.suse.com/1241766"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251460",
        "url": "https://bugzilla.suse.com/1251460"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251627",
        "url": "https://bugzilla.suse.com/1251627"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267110",
        "url": "https://bugzilla.suse.com/1267110"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45338 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25680 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25680/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25681 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25681/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27136 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27136/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42502 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42502/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42506/"
      }
    ],
    "title": "Security update for lux",
    "tracking": {
      "current_release_date": "2026-07-17T12:53:41Z",
      "generator": {
        "date": "2026-07-17T12:53:41Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21367-1",
      "initial_release_date": "2026-07-17T12:53:41Z",
      "revision_history": [
        {
          "date": "2026-07-17T12:53:41Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lux-0.24.1-bp160.1.1.aarch64",
                "product": {
                  "name": "lux-0.24.1-bp160.1.1.aarch64",
                  "product_id": "lux-0.24.1-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lux-0.24.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "lux-0.24.1-bp160.1.1.ppc64le",
                  "product_id": "lux-0.24.1-bp160.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lux-0.24.1-bp160.1.1.s390x",
                "product": {
                  "name": "lux-0.24.1-bp160.1.1.s390x",
                  "product_id": "lux-0.24.1-bp160.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lux-0.24.1-bp160.1.1.x86_64",
                "product": {
                  "name": "lux-0.24.1-bp160.1.1.x86_64",
                  "product_id": "lux-0.24.1-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lux-0.24.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64"
        },
        "product_reference": "lux-0.24.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lux-0.24.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le"
        },
        "product_reference": "lux-0.24.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lux-0.24.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x"
        },
        "product_reference": "lux-0.24.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lux-0.24.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        },
        "product_reference": "lux-0.24.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45338",
          "url": "https://www.suse.com/security/cve/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234794 for CVE-2024-45338",
          "url": "https://bugzilla.suse.com/1234794"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45338"
    },
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265255 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1265255"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265256 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1265256"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265259 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1265259"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    },
    {
      "cve": "CVE-2026-25680",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25680"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25680",
          "url": "https://www.suse.com/security/cve/CVE-2026-25680"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-25680",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25680"
    },
    {
      "cve": "CVE-2026-25681",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25681"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25681",
          "url": "https://www.suse.com/security/cve/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-25681",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25681"
    },
    {
      "cve": "CVE-2026-27136",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27136"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27136",
          "url": "https://www.suse.com/security/cve/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-27136",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27136"
    },
    {
      "cve": "CVE-2026-42502",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42502"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42502",
          "url": "https://www.suse.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-42502",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42502"
    },
    {
      "cve": "CVE-2026-42506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42506",
          "url": "https://www.suse.com/security/cve/CVE-2026-42506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-42506",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:lux-0.24.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-17T12:53:41Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42506"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.