OPENSUSE-SU-2026:22032-1
Vulnerability from csaf_opensuse - Published: 2026-10-06 13:15 - Updated: 2026-10-08 18:03Summary
Security update for alloy
Severity
Important
Notes
Title of the patch: Security update for alloy
Description of the patch: This update for alloy fixes the following issues:
- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling
(bsc#1269861).
- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST
request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS
via oversized inputs (bsc#1276742).
- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to
exfiltration of sensitive data (bsc#1267482).
- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS
(bsc#1267483).
- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI
out-of-bounds reads to leak memory into telemetry (bsc#1267484).
- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause
that memory to be copied into telemetry (bsc#1267486).
- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to
read and overwrite memory beyond the first segment (bsc#1267487).
- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a
parameter value overflows the message buffer (bsc#1272418).
- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler
agent (bsc#1268982).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278671).
- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage
(bsc#1276992).
- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can
modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`
(bsc#1277429).
- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in
Client.BulkWrite (bsc#1278693).
- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames
containing a crafted header value type byte outside the valid range can cause the host process to terminate
(bsc#1280671).
Changes for alloy:
Update to version 1.19.2:
* Remove withdrawn lib/pq CVEs from govulncheck
* Add backticks to component name in generated doc output
* BREAKING CHANGE: prometheus.operator.servicemonitors now
rejects endpoints that reference local files by default. Set
allow_arbitrary_file_access = true to preserve previous
behavior.
* prometheus.enrich: Support multi-label matching
* prometheus.relabel: Add opt-in TTL cache mode
* telemetry: Add new metrics for graph connections and
pyroscope forwarded entries
* database_observability: Exclude system schemas from MySQL
health checks and redact query text in explain_plans
* Add nop receiver to OTel Engine
* Backport dependency upgrades to address GO-2026-6061
Patchnames: openSUSE-Leap-16.0-1848
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.4 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
6.2 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
important
7.1 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
7.7 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-2303
Threats
Impact
moderate
References
80 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for alloy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for alloy fixes the following issues:\n\n- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling\n (bsc#1269861).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n via oversized inputs (bsc#1276742).\n- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to\n exfiltration of sensitive data (bsc#1267482).\n- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS\n (bsc#1267483).\n- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI\n out-of-bounds reads to leak memory into telemetry (bsc#1267484).\n- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause\n that memory to be copied into telemetry (bsc#1267486).\n- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to\n read and overwrite memory beyond the first segment (bsc#1267487).\n- CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a\n parameter value overflows the message buffer (bsc#1272418).\n- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler\n agent (bsc#1268982).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n crypto/ssh library (bsc#1278671).\n- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).\n- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage\n (bsc#1276992).\n- CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can\n modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile`\n (bsc#1277429).\n- CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in\n Client.BulkWrite (bsc#1278693).\n- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames\n containing a crafted header value type byte outside the valid range can cause the host process to terminate\n (bsc#1280671).\n\nChanges for alloy:\n\nUpdate to version 1.19.2:\n\n * Remove withdrawn lib/pq CVEs from govulncheck\n * Add backticks to component name in generated doc output\n * BREAKING CHANGE: prometheus.operator.servicemonitors now\n rejects endpoints that reference local files by default. Set\n allow_arbitrary_file_access = true to preserve previous\n behavior.\n * prometheus.enrich: Support multi-label matching\n * prometheus.relabel: Add opt-in TTL cache mode\n * telemetry: Add new metrics for graph connections and\n pyroscope forwarded entries\n * database_observability: Exclude system schemas from MySQL\n health checks and redact query text in explain_plans\n * Add nop receiver to OTel Engine\n * Backport dependency upgrades to address GO-2026-6061\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1848",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22032-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1267482",
"url": "https://bugzilla.suse.com/1267482"
},
{
"category": "self",
"summary": "SUSE Bug 1267483",
"url": "https://bugzilla.suse.com/1267483"
},
{
"category": "self",
"summary": "SUSE Bug 1267484",
"url": "https://bugzilla.suse.com/1267484"
},
{
"category": "self",
"summary": "SUSE Bug 1267486",
"url": "https://bugzilla.suse.com/1267486"
},
{
"category": "self",
"summary": "SUSE Bug 1267487",
"url": "https://bugzilla.suse.com/1267487"
},
{
"category": "self",
"summary": "SUSE Bug 1268982",
"url": "https://bugzilla.suse.com/1268982"
},
{
"category": "self",
"summary": "SUSE Bug 1269861",
"url": "https://bugzilla.suse.com/1269861"
},
{
"category": "self",
"summary": "SUSE Bug 1272028",
"url": "https://bugzilla.suse.com/1272028"
},
{
"category": "self",
"summary": "SUSE Bug 1272418",
"url": "https://bugzilla.suse.com/1272418"
},
{
"category": "self",
"summary": "SUSE Bug 1276742",
"url": "https://bugzilla.suse.com/1276742"
},
{
"category": "self",
"summary": "SUSE Bug 1276982",
"url": "https://bugzilla.suse.com/1276982"
},
{
"category": "self",
"summary": "SUSE Bug 1276992",
"url": "https://bugzilla.suse.com/1276992"
},
{
"category": "self",
"summary": "SUSE Bug 1277429",
"url": "https://bugzilla.suse.com/1277429"
},
{
"category": "self",
"summary": "SUSE Bug 1277996",
"url": "https://bugzilla.suse.com/1277996"
},
{
"category": "self",
"summary": "SUSE Bug 1278671",
"url": "https://bugzilla.suse.com/1278671"
},
{
"category": "self",
"summary": "SUSE Bug 1278693",
"url": "https://bugzilla.suse.com/1278693"
},
{
"category": "self",
"summary": "SUSE Bug 1280671",
"url": "https://bugzilla.suse.com/1280671"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-2303 page",
"url": "https://www.suse.com/security/cve/CVE-2026-2303/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-37236 page",
"url": "https://www.suse.com/security/cve/CVE-2026-37236/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41178 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41178/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-45679 page",
"url": "https://www.suse.com/security/cve/CVE-2026-45679/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-45680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-45680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-45681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-45681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-45683 page",
"url": "https://www.suse.com/security/cve/CVE-2026-45683/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-45684 page",
"url": "https://www.suse.com/security/cve/CVE-2026-45684/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46600 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46600/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48496 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48496/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56852 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56852/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56854 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56854/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56855 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56855/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-71556 page",
"url": "https://www.suse.com/security/cve/CVE-2026-71556/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-71557 page",
"url": "https://www.suse.com/security/cve/CVE-2026-71557/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-75889 page",
"url": "https://www.suse.com/security/cve/CVE-2026-75889/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78662 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78662/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-81521 page",
"url": "https://www.suse.com/security/cve/CVE-2026-81521/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89090 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89090/"
}
],
"title": "Security update for alloy",
"tracking": {
"current_release_date": "2026-10-08T18:03:03Z",
"generator": {
"date": "2026-10-06T13:15:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:22032-1",
"initial_release_date": "2026-10-06T13:15:27Z",
"revision_history": [
{
"date": "2026-10-06T13:15:27Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-08T18:03:03Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "alloy-0:1.19.2-160000.1.1.aarch64",
"product": {
"name": "alloy-0:1.19.2-160000.1.1.aarch64",
"product_id": "alloy-0:1.19.2-160000.1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/alloy@1.19.2-160000.1.1?arch=aarch64\u0026upstream=alloy-0:1.19.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-0:1.19.2-160000.1.1.ppc64le",
"product": {
"name": "alloy-0:1.19.2-160000.1.1.ppc64le",
"product_id": "alloy-0:1.19.2-160000.1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/alloy@1.19.2-160000.1.1?arch=ppc64le\u0026upstream=alloy-0:1.19.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-0:1.19.2-160000.1.1.s390x",
"product": {
"name": "alloy-0:1.19.2-160000.1.1.s390x",
"product_id": "alloy-0:1.19.2-160000.1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/alloy@1.19.2-160000.1.1?arch=s390x\u0026upstream=alloy-0:1.19.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-0:1.19.2-160000.1.1.x86_64",
"product": {
"name": "alloy-0:1.19.2-160000.1.1.x86_64",
"product_id": "alloy-0:1.19.2-160000.1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/alloy@1.19.2-160000.1.1?arch=x86_64\u0026upstream=alloy-0:1.19.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-0:1.19.2-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64"
},
"product_reference": "alloy-0:1.19.2-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-0:1.19.2-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le"
},
"product_reference": "alloy-0:1.19.2-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-0:1.19.2-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x"
},
"product_reference": "alloy-0:1.19.2-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-0:1.19.2-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
},
"product_reference": "alloy-0:1.19.2-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-2303",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-2303"
}
],
"notes": [
{
"category": "general",
"text": "The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-2303",
"url": "https://www.suse.com/security/cve/CVE-2026-2303"
},
{
"category": "external",
"summary": "SUSE Bug 1268652 for CVE-2026-2303",
"url": "https://bugzilla.suse.com/1268652"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-2303"
},
{
"cve": "CVE-2026-37236",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-37236"
}
],
"notes": [
{
"category": "general",
"text": "grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-37236",
"url": "https://www.suse.com/security/cve/CVE-2026-37236"
},
{
"category": "external",
"summary": "SUSE Bug 1277941 for CVE-2026-37236",
"url": "https://bugzilla.suse.com/1277941"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-37236"
},
{
"cve": "CVE-2026-41178",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41178"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41178",
"url": "https://www.suse.com/security/cve/CVE-2026-41178"
},
{
"category": "external",
"summary": "SUSE Bug 1276509 for CVE-2026-41178",
"url": "https://bugzilla.suse.com/1276509"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-41178"
},
{
"cve": "CVE-2026-45679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-45679"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-45679",
"url": "https://www.suse.com/security/cve/CVE-2026-45679"
},
{
"category": "external",
"summary": "SUSE Bug 1267482 for CVE-2026-45679",
"url": "https://bugzilla.suse.com/1267482"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-45679"
},
{
"cve": "CVE-2026-45680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-45680"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-45680",
"url": "https://www.suse.com/security/cve/CVE-2026-45680"
},
{
"category": "external",
"summary": "SUSE Bug 1267483 for CVE-2026-45680",
"url": "https://bugzilla.suse.com/1267483"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-45680"
},
{
"cve": "CVE-2026-45681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-45681"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-45681",
"url": "https://www.suse.com/security/cve/CVE-2026-45681"
},
{
"category": "external",
"summary": "SUSE Bug 1267484 for CVE-2026-45681",
"url": "https://bugzilla.suse.com/1267484"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-45681"
},
{
"cve": "CVE-2026-45683",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-45683"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-45683",
"url": "https://www.suse.com/security/cve/CVE-2026-45683"
},
{
"category": "external",
"summary": "SUSE Bug 1267486 for CVE-2026-45683",
"url": "https://bugzilla.suse.com/1267486"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-45683"
},
{
"cve": "CVE-2026-45684",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-45684"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI\u0027s log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-45684",
"url": "https://www.suse.com/security/cve/CVE-2026-45684"
},
{
"category": "external",
"summary": "SUSE Bug 1267487 for CVE-2026-45684",
"url": "https://bugzilla.suse.com/1267487"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-45684"
},
{
"cve": "CVE-2026-46600",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46600"
}
],
"notes": [
{
"category": "general",
"text": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46600",
"url": "https://www.suse.com/security/cve/CVE-2026-46600"
},
{
"category": "external",
"summary": "SUSE Bug 1272415 for CVE-2026-46600",
"url": "https://bugzilla.suse.com/1272415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-46600"
},
{
"cve": "CVE-2026-48496",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48496"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48496",
"url": "https://www.suse.com/security/cve/CVE-2026-48496"
},
{
"category": "external",
"summary": "SUSE Bug 1268982 for CVE-2026-48496",
"url": "https://bugzilla.suse.com/1268982"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-48496"
},
{
"cve": "CVE-2026-56852",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56852"
}
],
"notes": [
{
"category": "general",
"text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56852",
"url": "https://www.suse.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "SUSE Bug 1271661 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1271661"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-56852",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-56852"
},
{
"cve": "CVE-2026-56854",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56854"
}
],
"notes": [
{
"category": "general",
"text": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56854",
"url": "https://www.suse.com/security/cve/CVE-2026-56854"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-56854",
"url": "https://bugzilla.suse.com/1278446"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-56854",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "important"
}
],
"title": "CVE-2026-56854"
},
{
"cve": "CVE-2026-56855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56855"
}
],
"notes": [
{
"category": "general",
"text": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56855",
"url": "https://www.suse.com/security/cve/CVE-2026-56855"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-56855",
"url": "https://bugzilla.suse.com/1278446"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-56855",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "important"
}
],
"title": "CVE-2026-56855"
},
{
"cve": "CVE-2026-71556",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-71556"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-71556",
"url": "https://www.suse.com/security/cve/CVE-2026-71556"
},
{
"category": "external",
"summary": "SUSE Bug 1276977 for CVE-2026-71556",
"url": "https://bugzilla.suse.com/1276977"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "important"
}
],
"title": "CVE-2026-71556"
},
{
"cve": "CVE-2026-71557",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-71557"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-71557",
"url": "https://www.suse.com/security/cve/CVE-2026-71557"
},
{
"category": "external",
"summary": "SUSE Bug 1276986 for CVE-2026-71557",
"url": "https://bugzilla.suse.com/1276986"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-71557"
},
{
"cve": "CVE-2026-75889",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-75889"
}
],
"notes": [
{
"category": "general",
"text": "Grafana Alloy\u0027s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy\u0027s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy\u0027s service account.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-75889",
"url": "https://www.suse.com/security/cve/CVE-2026-75889"
},
{
"category": "external",
"summary": "SUSE Bug 1277429 for CVE-2026-75889",
"url": "https://bugzilla.suse.com/1277429"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "important"
}
],
"title": "CVE-2026-75889"
},
{
"cve": "CVE-2026-78662",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78662"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a channel registered in the mux\u0027s chanList is not usable until it is established. A malicious peer was able flood the channel\u0027s incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78662",
"url": "https://www.suse.com/security/cve/CVE-2026-78662"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-78662",
"url": "https://bugzilla.suse.com/1278446"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-78662",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "important"
}
],
"title": "CVE-2026-78662"
},
{
"cve": "CVE-2026-81521",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-81521"
}
],
"notes": [
{
"category": "general",
"text": "The MongoDB Go Driver\u0027s client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-81521",
"url": "https://www.suse.com/security/cve/CVE-2026-81521"
},
{
"category": "external",
"summary": "SUSE Bug 1278693 for CVE-2026-81521",
"url": "https://bugzilla.suse.com/1278693"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-81521"
},
{
"cve": "CVE-2026-89090",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89090"
}
],
"notes": [
{
"category": "general",
"text": "An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.\n\n\n\nTo remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89090",
"url": "https://www.suse.com/security/cve/CVE-2026-89090"
},
{
"category": "external",
"summary": "SUSE Bug 1280622 for CVE-2026-89090",
"url": "https://bugzilla.suse.com/1280622"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-0:1.19.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-06T13:15:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-89090"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…