Vulnerability-Lookup

SUSE-SU-2026:23522-1

Vulnerability from csaf_suse - Published: 2026-09-04 09:08 - Updated: 2026-09-15 16:10

Summary

Security update for helm

Severity

Moderate

Notes

Title of the patch: Security update for helm

Description of the patch: This update for helm fixes the following issues: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949). - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic (bsc#1272402). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Patchnames: SUSE-SLE-Micro-6.1-709

CVE-2026-37236

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 5 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-41178

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 5 products, the same list as for CVE-2026-37236

Threats

Impact moderate

CVE-2026-48978

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Recommended 5 products, the same list as for CVE-2026-37236

Threats

Impact moderate

CVE-2026-50151

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 5 products, the same list as for CVE-2026-37236

Threats

Impact important

CVE-2026-63308

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 5 products, the same list as for CVE-2026-37236

Threats

Impact moderate

References

25 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1270127	self
https://bugzilla.suse.com/1271660	self
https://bugzilla.suse.com/1272402	self
https://bugzilla.suse.com/1276510	self
https://bugzilla.suse.com/1276514	self
https://bugzilla.suse.com/1277949	self
https://www.suse.com/security/cve/CVE-2026-37236/	self
https://www.suse.com/security/cve/CVE-2026-41178/	self
https://www.suse.com/security/cve/CVE-2026-48978/	self
https://www.suse.com/security/cve/CVE-2026-50151/	self
https://www.suse.com/security/cve/CVE-2026-63308/	self
https://www.suse.com/security/cve/CVE-2026-37236	external
https://bugzilla.suse.com/1277941	external
https://www.suse.com/security/cve/CVE-2026-41178	external
https://bugzilla.suse.com/1276509	external
https://www.suse.com/security/cve/CVE-2026-48978	external
https://bugzilla.suse.com/1270126	external
https://www.suse.com/security/cve/CVE-2026-50151	external
https://bugzilla.suse.com/1271461	external
https://www.suse.com/security/cve/CVE-2026-63308	external
https://bugzilla.suse.com/1272402	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for helm",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for helm fixes the following issues:\n\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n  request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-range panic\n  (bsc#1272402).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-709",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23522-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:23522-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623522-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:23522-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/029030.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1270127",
        "url": "https://bugzilla.suse.com/1270127"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271660",
        "url": "https://bugzilla.suse.com/1271660"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272402",
        "url": "https://bugzilla.suse.com/1272402"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276510",
        "url": "https://bugzilla.suse.com/1276510"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276514",
        "url": "https://bugzilla.suse.com/1276514"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1277949",
        "url": "https://bugzilla.suse.com/1277949"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-37236 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-37236/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41178 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41178/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48978 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48978/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-50151 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-50151/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-63308 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-63308/"
      }
    ],
    "title": "Security update for helm",
    "tracking": {
      "current_release_date": "2026-09-15T16:10:28Z",
      "generator": {
        "date": "2026-09-04T09:08:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:23522-1",
      "initial_release_date": "2026-09-04T09:08:39Z",
      "revision_history": [
        {
          "date": "2026-09-04T09:08:39Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-15T16:10:28Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.21.3-slfo.1.1_2.1.aarch64",
                "product": {
                  "name": "helm-3.21.3-slfo.1.1_2.1.aarch64",
                  "product_id": "helm-3.21.3-slfo.1.1_2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch",
                "product": {
                  "name": "helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch",
                  "product_id": "helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.21.3-slfo.1.1_2.1.ppc64le",
                "product": {
                  "name": "helm-3.21.3-slfo.1.1_2.1.ppc64le",
                  "product_id": "helm-3.21.3-slfo.1.1_2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.21.3-slfo.1.1_2.1.s390x",
                "product": {
                  "name": "helm-3.21.3-slfo.1.1_2.1.s390x",
                  "product_id": "helm-3.21.3-slfo.1.1_2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-3.21.3-slfo.1.1_2.1.x86_64",
                "product": {
                  "name": "helm-3.21.3-slfo.1.1_2.1.x86_64",
                  "product_id": "helm-3.21.3-slfo.1.1_2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.21.3-slfo.1.1_2.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64"
        },
        "product_reference": "helm-3.21.3-slfo.1.1_2.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.21.3-slfo.1.1_2.1.ppc64le as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le"
        },
        "product_reference": "helm-3.21.3-slfo.1.1_2.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.21.3-slfo.1.1_2.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x"
        },
        "product_reference": "helm-3.21.3-slfo.1.1_2.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-3.21.3-slfo.1.1_2.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64"
        },
        "product_reference": "helm-3.21.3-slfo.1.1_2.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
        },
        "product_reference": "helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-37236",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-37236"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
          "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-37236",
          "url": "https://www.suse.com/security/cve/CVE-2026-37236"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1277941 for CVE-2026-37236",
          "url": "https://bugzilla.suse.com/1277941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-04T09:08:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-37236"
    },
    {
      "cve": "CVE-2026-41178",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41178"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
          "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41178",
          "url": "https://www.suse.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276509 for CVE-2026-41178",
          "url": "https://bugzilla.suse.com/1276509"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-04T09:08:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41178"
    },
    {
      "cve": "CVE-2026-48978",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48978"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry\u0027s WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
          "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48978",
          "url": "https://www.suse.com/security/cve/CVE-2026-48978"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270126 for CVE-2026-48978",
          "url": "https://bugzilla.suse.com/1270126"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-04T09:08:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48978"
    },
    {
      "cve": "CVE-2026-50151",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-50151"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller\u0027s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
          "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-50151",
          "url": "https://www.suse.com/security/cve/CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271461 for CVE-2026-50151",
          "url": "https://bugzilla.suse.com/1271461"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-04T09:08:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-50151"
    },
    {
      "cve": "CVE-2026-63308",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-63308"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
          "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
          "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-63308",
          "url": "https://www.suse.com/security/cve/CVE-2026-63308"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272402 for CVE-2026-63308",
          "url": "https://bugzilla.suse.com/1272402"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.aarch64",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.ppc64le",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.s390x",
            "SUSE Linux Micro 6.1:helm-3.21.3-slfo.1.1_2.1.x86_64",
            "SUSE Linux Micro 6.1:helm-bash-completion-3.21.3-slfo.1.1_2.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-04T09:08:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-63308"
    }
  ]
}

CVE-2026-37236 (GCVE-0-2026-37236)

Vulnerability from cvelistv5 – Published: 2026-08-28 00:00 – Updated: 2026-09-02 18:14

Summary

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:14 UTC

CWE

n/a
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

mitre mitre root

References

3 references

URL	Tags
https://github.com/grpc-ecosystem/grpc-gateway/co…
https://github.com/grpc-ecosystem/grpc-gateway
https://s00me00ne.com/cve/cve-2026-37236/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-37236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:14:19.654475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-639",
                "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:14:42.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T14:06:18.076Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/grpc-ecosystem/grpc-gateway/commit/72123cd4f32545f6e1376873f412dcdcbcf29acc"
        },
        {
          "url": "https://github.com/grpc-ecosystem/grpc-gateway"
        },
        {
          "url": "https://s00me00ne.com/cve/cve-2026-37236/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-37236",
    "datePublished": "2026-08-28T00:00:00.000Z",
    "dateReserved": "2026-04-06T00:00:00.000Z",
    "dateUpdated": "2026-09-02T18:14:42.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41178 (GCVE-0-2026-41178)

Vulnerability from cvelistv5 – Published: 2026-06-04 14:38 – Updated: 2026-06-04 15:46

Title

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 15:46 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
open-telemetry	go.opentelemetry.io/otel/baggage	Affected: = 1.41.0 Affected: = 1.43.0
open-telemetry	go.opentelemetry.io/otel/propagation	Affected: = 1.41.0 Affected: = 1.43.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41178",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T15:46:06.715583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T15:46:11.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go.opentelemetry.io/otel/baggage",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        },
        {
          "product": "go.opentelemetry.io/otel/propagation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.41.0"
            },
            {
              "status": "affected",
              "version": "= 1.43.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T14:38:23.707Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        }
      ],
      "source": {
        "advisory": "GHSA-5wrp-cwcj-q835",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go\u0027s baggage parsing no longer caps raw header length"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41178",
    "datePublished": "2026-06-04T14:38:23.707Z",
    "dateReserved": "2026-04-17T16:34:45.526Z",
    "dateUpdated": "2026-06-04T15:46:11.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48978 (GCVE-0-2026-48978)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:34 – Updated: 2026-07-21 02:06

Title

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 02:06 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)
CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/oras-project/oras-go/security/…	x_refsource_CONFIRM
https://github.com/oras-project/oras-go/commit/7a…	x_refsource_MISC
https://github.com/oras-project/oras-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
oras-project	oras-go	Affected: < 2.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48978",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T02:06:39.340086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T02:06:49.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry\u0027s WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:34:53.690Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w"
        },
        {
          "name": "https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764"
        },
        {
          "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1"
        }
      ],
      "source": {
        "advisory": "GHSA-xf85-363p-868w",
        "discovery": "UNKNOWN"
      },
      "title": "oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48978",
    "datePublished": "2026-07-17T19:34:53.690Z",
    "dateReserved": "2026-05-26T23:26:07.974Z",
    "dateUpdated": "2026-07-21T02:06:49.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50151 (GCVE-0-2026-50151)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:41 – Updated: 2026-07-20 13:52

Title

oras-go: credential forwarding via unvalidated Location header in blob upload

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 13:52 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/oras-project/oras-go/security/…	x_refsource_CONFIRM
https://github.com/oras-project/oras-go/pull/1152	x_refsource_MISC
https://github.com/oras-project/oras-go/commit/46…	x_refsource_MISC
https://github.com/oras-project/oras-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
oras-project	oras-go	Affected: < 2.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50151",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:52:00.588088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:52:07.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller\u0027s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:41:11.648Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
        },
        {
          "name": "https://github.com/oras-project/oras-go/pull/1152",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/pull/1152"
        },
        {
          "name": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991"
        },
        {
          "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1"
        }
      ],
      "source": {
        "advisory": "GHSA-jxpm-75mh-9fp7",
        "discovery": "UNKNOWN"
      },
      "title": "oras-go: credential forwarding via unvalidated Location header in blob upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50151",
    "datePublished": "2026-07-17T19:41:11.648Z",
    "dateReserved": "2026-06-03T20:54:20.431Z",
    "dateUpdated": "2026-07-20T13:52:07.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63308 (GCVE-0-2026-63308)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:14 – Updated: 2026-07-17 17:25 X_Open Source

Title

Helm Files.Lines Denial of Service via Empty Chart Files

Summary

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:25 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/helm/helm/issues/32279	technical-descriptionexploit
https://github.com/helm/helm/pull/32290	issue-tracking
https://github.com/helm/helm/commit/ba6c9a29efa7b…	patch
https://www.vulncheck.com/advisories/chat2db-inse…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
helm	helm	Affected: 0 , ≤ 4.2.3 (semver) Unaffected: ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017 (git) cpe:2.3:a:helm:helm::::::::

Date Public

2026-07-01 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63308",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:25:36.932375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T17:25:42.234Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/helm.sh/helm/v4",
          "product": "helm",
          "repo": "https://github.com/helm/helm",
          "vendor": "helm",
          "versions": [
            {
              "lessThanOrEqual": "4.2.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.2.3",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:14:15.472Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://github.com/helm/helm/issues/32279"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/helm/helm/pull/32290"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-via-get-api-connection-datasource"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Helm Files.Lines Denial of Service via Empty Chart Files",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-63308",
    "datePublished": "2026-07-17T16:14:15.472Z",
    "dateReserved": "2026-07-16T12:13:18.733Z",
    "dateUpdated": "2026-07-17T17:25:42.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:23522-1

CVE-2026-37236 (GCVE-0-2026-37236)

CVE-2026-41178 (GCVE-0-2026-41178)

CVE-2026-48978 (GCVE-0-2026-48978)

CVE-2026-50151 (GCVE-0-2026-50151)

CVE-2026-63308 (GCVE-0-2026-63308)

Tags

Sightings

Nomenclature

Related by attack behaviour