{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for trivy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for trivy fixes the following issues\n\n- CVE-2025-64702: github.com/quic-go/quic-go/http3: quic-go HTTP/3 QPACK Header Expansion DoS (bsc#1255366).\n- CVE-2025-69725: github.com/go-chi/chi/v5: incorrect input validation in the RedirectSlashes function can lead to an\n  open redirect (bsc#1258513).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258094).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260193).\n- CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written\n  outside of the BuildKit state directory (bsc#1260971).\n- CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components may allow\n  access to files outside the checked-out Git repository (bsc#1261052).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262893).\n- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be\n  used to bypass some authorization controls (bsc#1262389).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264873).\n\nChanges for trivy:\n\n- Updated go-git to 5.18.0.\n- Updated to version 0.70.0.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-759",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20809-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255366",
        "url": "https://bugzilla.suse.com/1255366"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258094",
        "url": "https://bugzilla.suse.com/1258094"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258513",
        "url": "https://bugzilla.suse.com/1258513"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260193",
        "url": "https://bugzilla.suse.com/1260193"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1260971",
        "url": "https://bugzilla.suse.com/1260971"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261052",
        "url": "https://bugzilla.suse.com/1261052"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262389",
        "url": "https://bugzilla.suse.com/1262389"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262893",
        "url": "https://bugzilla.suse.com/1262893"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1264873",
        "url": "https://bugzilla.suse.com/1264873"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64702 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64702/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69725 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69725/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25934 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25934/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33747 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33747/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33748 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33748/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39984 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39984/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41506/"
      }
    ],
    "title": "Security update for trivy",
    "tracking": {
      "current_release_date": "2026-09-17T17:33:12Z",
      "generator": {
        "date": "2026-05-17T21:24:43Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20809-1",
      "initial_release_date": "2026-05-17T21:24:43Z",
      "revision_history": [
        {
          "date": "2026-05-17T21:24:43Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:35:35Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:38:32Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:33:12Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.70.0-160000.1.1.aarch64",
                "product": {
                  "name": "trivy-0:0.70.0-160000.1.1.aarch64",
                  "product_id": "trivy-0:0.70.0-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.70.0-160000.1.1?arch=aarch64\u0026upstream=trivy-0:0.70.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.70.0-160000.1.1.ppc64le",
                "product": {
                  "name": "trivy-0:0.70.0-160000.1.1.ppc64le",
                  "product_id": "trivy-0:0.70.0-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.70.0-160000.1.1?arch=ppc64le\u0026upstream=trivy-0:0.70.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.70.0-160000.1.1.s390x",
                "product": {
                  "name": "trivy-0:0.70.0-160000.1.1.s390x",
                  "product_id": "trivy-0:0.70.0-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.70.0-160000.1.1?arch=s390x\u0026upstream=trivy-0:0.70.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.70.0-160000.1.1.x86_64",
                "product": {
                  "name": "trivy-0:0.70.0-160000.1.1.x86_64",
                  "product_id": "trivy-0:0.70.0-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.70.0-160000.1.1?arch=x86_64\u0026upstream=trivy-0:0.70.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.70.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64"
        },
        "product_reference": "trivy-0:0.70.0-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.70.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le"
        },
        "product_reference": "trivy-0:0.70.0-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.70.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x"
        },
        "product_reference": "trivy-0:0.70.0-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.70.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        },
        "product_reference": "trivy-0:0.70.0-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64702",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64702"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go\u0027s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64702",
          "url": "https://www.suse.com/security/cve/CVE-2025-64702"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255365 for CVE-2025-64702",
          "url": "https://bugzilla.suse.com/1255365"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271244 for CVE-2025-64702",
          "url": "https://bugzilla.suse.com/1271244"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64702"
    },
    {
      "cve": "CVE-2025-69725",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69725"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69725",
          "url": "https://www.suse.com/security/cve/CVE-2025-69725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258511 for CVE-2025-69725",
          "url": "https://bugzilla.suse.com/1258511"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-69725"
    },
    {
      "cve": "CVE-2026-25934",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25934"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25934",
          "url": "https://www.suse.com/security/cve/CVE-2026-25934"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258093 for CVE-2026-25934",
          "url": "https://bugzilla.suse.com/1258093"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-25934"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268676 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1268676"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33747",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33747"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33747",
          "url": "https://www.suse.com/security/cve/CVE-2026-33747"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260954 for CVE-2026-33747",
          "url": "https://bugzilla.suse.com/1260954"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33747"
    },
    {
      "cve": "CVE-2026-33748",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33748"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33748",
          "url": "https://www.suse.com/security/cve/CVE-2026-33748"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261046 for CVE-2026-33748",
          "url": "https://bugzilla.suse.com/1261046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33748"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    },
    {
      "cve": "CVE-2026-39984",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39984"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39984",
          "url": "https://www.suse.com/security/cve/CVE-2026-39984"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262338 for CVE-2026-39984",
          "url": "https://bugzilla.suse.com/1262338"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39984"
    },
    {
      "cve": "CVE-2026-41506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41506",
          "url": "https://www.suse.com/security/cve/CVE-2026-41506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264854 for CVE-2026-41506",
          "url": "https://bugzilla.suse.com/1264854"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.70.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-17T21:24:43Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41506"
    }
  ]
}