OPENSUSE-SU-2026:21645-1

Vulnerability from csaf_opensuse - Published: 2026-08-25 07:22 - Updated: 2026-09-17 17:42
Summary
Security update for trivy
Severity
Moderate
Notes
Title of the patch: Security update for trivy
Description of the patch: This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery (bsc#1276128). Changes for trivy: - Update to version 0.74.0: * release: v0.74.0 [main] (#11037) * chore(deps): update golang.org/x modules (#11094) * chore(deps): bump the docker group with 2 updates (#11090) * docs: update release branch ruleset instructions (#11093) * chore(deps): bump the common group across 1 directory with 7 updates (#11086) * fix(misconf): unmark cty values outside the evaluation context (#11078) * chore(deps): bump the aws group across 1 directory with 6 updates (#11053) * fix(misconf): parse Azure flexible server parameters under their own names (#11072) * chore(deps): bump the docker group with 2 updates (#11054) * feat: add RapidFort curated image scanner (#10452) * feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948) * refactor(misconf): remove unused Azure expression-related code (#10637) * fix(server): preserve check aliases and query in uploaded blobs (#11080) * fix(java): read artifact properties only from the MANIFEST.MF main section (#11066) * fix(terraform): support OpenTofu language block (#10923) * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063) * ci: trigger Auto Ready for Review after Test docs (#11045) * docs: remove trivy-checks from AWS ECR locations (#11044) * refactor(ubuntu): move EOL version resolution out of loop (#11047) * fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050) * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042) * chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038) * fix(terraform): avoid panic when for_each local has unknown object values (#11019) * chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028) * ci(spdx): migrate to Slack notifications (#11032) * ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034) - Update to version 0.73.0: * release: v0.73.0 [main] (#11012) * docs: clarify debug logs when version check or telemetry is disabled (#10984) * feat(java): support user-defined Maven mirrors in trivy.yaml (#11006) * chore(deps): bump the common group across 1 directory with 17 updates (#11025) * chore(deps): bump the docker group across 1 directory with 2 updates (#10991) * chore(deps): bump the aws group across 1 directory with 6 updates (#10947) * refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013) * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995) * feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986) * refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007) * chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009) * fix(vex): reject non-local VEX repository names (#10987) * fix(vex): handle 304 status code (#10307) * fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980) * fix(conda): avoid panic on an all-operator dependency line (#10955) * chore: add schema id (#10969) * feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932) * feat: add bounded read helpers (#10974) * fix(dotnet): identify deps.json root project from dependency graph (#10954) * feat(java): read Jenkins plugin manifest licenses (#10939) * docs: ask contributors to coordinate before starting on an issue (#10940) * fix(nodejs): support pnpm workspaces with overlapping packages (#10894) * ci: create release branch with the App token to bypass the merge queue rule (#10931) * chore(deps): bump the common group across 1 directory with 15 updates (#10892) * feat(seal): detect no-prefix packages by version suffix (#10911) * chore(deps): bump the testcontainers group with 2 updates (#10918) * chore(deps): bump the docker group across 1 directory with 4 updates (#10919) * fix(java): set per-file digest for nested JARs (#10855) * fix(misconf): guard nil Healthcheck when building Dockerfile from history (#10899) * ci(helm): bump Trivy version to 0.72.0 for Trivy Helm Chart 0.24.0 (#10908) * ci(helm): allow trivy team to approve Chart.yaml bumps (#10912)
Patchnames: openSUSE-Leap-16.0-1504
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-72815
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-72816
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-72815
Threats
Impact moderate
CVE-2026-72817
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-72815
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for trivy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for trivy fixes the following issue:\n\n- CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow\n  authentication bypass, authorization override, and log forgery (bsc#1276128).\n\nChanges for trivy:\n\n- Update to version 0.74.0:\n * release: v0.74.0 [main] (#11037)\n * chore(deps): update golang.org/x modules (#11094)\n * chore(deps): bump the docker group with 2 updates (#11090)\n * docs: update release branch ruleset instructions (#11093)\n * chore(deps): bump the common group across 1 directory with 7 updates (#11086)\n * fix(misconf): unmark cty values outside the evaluation context (#11078)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#11053)\n * fix(misconf): parse Azure flexible server parameters under their own names (#11072)\n * chore(deps): bump the docker group with 2 updates (#11054)\n * feat: add RapidFort curated image scanner (#10452)\n * feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom \u003curl\u003e) (#10948)\n * refactor(misconf): remove unused Azure expression-related code (#10637)\n * fix(server): preserve check aliases and query in uploaded blobs (#11080)\n * fix(java): read artifact properties only from the MANIFEST.MF main section (#11066)\n * fix(terraform): support OpenTofu language block (#10923)\n * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063)\n * ci: trigger Auto Ready for Review after Test docs (#11045)\n * docs: remove trivy-checks from AWS ECR locations (#11044)\n * refactor(ubuntu): move EOL version resolution out of loop (#11047)\n * fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050)\n * chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042)\n * chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038)\n * fix(terraform): avoid panic when for_each local has unknown object values (#11019)\n * chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028)\n * ci(spdx): migrate to Slack notifications (#11032)\n * ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034)\n- Update to version 0.73.0:\n * release: v0.73.0 [main] (#11012)\n * docs: clarify debug logs when version check or telemetry is disabled (#10984)\n * feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)\n * chore(deps): bump the common group across 1 directory with 17 updates (#11025)\n * chore(deps): bump the docker group across 1 directory with 2 updates (#10991)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#10947)\n * refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)\n * chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)\n * feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)\n * refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)\n * chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)\n * fix(vex): reject non-local VEX repository names (#10987)\n * fix(vex): handle 304 status code (#10307)\n * fix(vuln): don\u0027t skip packages covered by a driver\u0027s own advisory feed (#10980)\n * fix(conda): avoid panic on an all-operator dependency line (#10955)\n * chore: add schema id (#10969)\n * feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)\n * feat: add bounded read helpers (#10974)\n * fix(dotnet): identify deps.json root project from dependency graph (#10954)\n * feat(java): read Jenkins plugin manifest licenses (#10939)\n * docs: ask contributors to coordinate before starting on an issue (#10940)\n * fix(nodejs): support pnpm workspaces with overlapping packages (#10894)\n * ci: create release branch with the App token to bypass the merge queue rule (#10931)\n * chore(deps): bump the common group across 1 directory with 15 updates (#10892)\n * feat(seal): detect no-prefix packages by version suffix (#10911)\n * chore(deps): bump the testcontainers group with 2 updates (#10918)\n * chore(deps): bump the docker group across 1 directory with 4 updates (#10919)\n * fix(java): set per-file digest for nested JARs (#10855)\n * fix(misconf): guard nil Healthcheck when building Dockerfile from history (#10899)\n * ci(helm): bump Trivy version to 0.72.0 for Trivy Helm Chart 0.24.0 (#10908)\n * ci(helm): allow trivy team to approve Chart.yaml bumps (#10912)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1504",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21645-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276128",
        "url": "https://bugzilla.suse.com/1276128"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-72815 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-72815/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-72816 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-72816/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-72817 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-72817/"
      }
    ],
    "title": "Security update for trivy",
    "tracking": {
      "current_release_date": "2026-09-17T17:42:31Z",
      "generator": {
        "date": "2026-08-25T07:22:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21645-1",
      "initial_release_date": "2026-08-25T07:22:37Z",
      "revision_history": [
        {
          "date": "2026-08-25T07:22:37Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:46:00Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:47:02Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:42:31Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-160000.1.1.aarch64",
                "product": {
                  "name": "trivy-0:0.74.0-160000.1.1.aarch64",
                  "product_id": "trivy-0:0.74.0-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.74.0-160000.1.1?arch=aarch64\u0026upstream=trivy-0:0.74.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-160000.1.1.ppc64le",
                "product": {
                  "name": "trivy-0:0.74.0-160000.1.1.ppc64le",
                  "product_id": "trivy-0:0.74.0-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.74.0-160000.1.1?arch=ppc64le\u0026upstream=trivy-0:0.74.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-160000.1.1.s390x",
                "product": {
                  "name": "trivy-0:0.74.0-160000.1.1.s390x",
                  "product_id": "trivy-0:0.74.0-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.74.0-160000.1.1?arch=s390x\u0026upstream=trivy-0:0.74.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-160000.1.1.x86_64",
                "product": {
                  "name": "trivy-0:0.74.0-160000.1.1.x86_64",
                  "product_id": "trivy-0:0.74.0-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/trivy@0.74.0-160000.1.1?arch=x86_64\u0026upstream=trivy-0:0.74.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64"
        },
        "product_reference": "trivy-0:0.74.0-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le"
        },
        "product_reference": "trivy-0:0.74.0-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x"
        },
        "product_reference": "trivy-0:0.74.0-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
        },
        "product_reference": "trivy-0:0.74.0-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-72815",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-72815"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-chi chi versions \u003e= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-72815",
          "url": "https://www.suse.com/security/cve/CVE-2026-72815"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276072 for CVE-2026-72815",
          "url": "https://bugzilla.suse.com/1276072"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-25T07:22:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-72815"
    },
    {
      "cve": "CVE-2026-72816",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-72816"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-72816",
          "url": "https://www.suse.com/security/cve/CVE-2026-72816"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276072 for CVE-2026-72816",
          "url": "https://bugzilla.suse.com/1276072"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-25T07:22:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-72816"
    },
    {
      "cve": "CVE-2026-72817",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-72817"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
          "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-72817",
          "url": "https://www.suse.com/security/cve/CVE-2026-72817"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276072 for CVE-2026-72817",
          "url": "https://bugzilla.suse.com/1276072"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.s390x",
            "openSUSE Leap 16.0:trivy-0:0.74.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-25T07:22:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-72817"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.