This update for perl-HTTP-Tiny fixes the following issues:

Changes in perl-HTTP-Tiny:

- updated to 0.096
- CVE-2026-7017: Fixed forwarded credential headers to cross-origin redirect targets (bsc#1271020)
- Caller-supplied Authorization, Cookie, and Proxy-Authorization
  headers are now stripped on cross-origin redirects by default. Use
  allow_credentialed_redirects to opt out.
- Redirects are no longer automatically followed when going from https to http.
  Use allow_downgrade to revert to the original behaviour.

GCVE Database

Detailed information about Security update for perl-HTTP-Tiny affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigatio

Security update for perl-HTTP-Tiny - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE ratings

URL of this CSAF notice

SUSE Bug 1271020

SUSE CVE CVE-2026-7017 page

Security update for perl-HTTP-Tiny

This update for dnsdist fixes the following issues:

Update to 1.9.15.

Changes for dnsdist:

- https://www.dnsdist.org/changelog.html#change-1.9.15
- https://www.dnsdist.org/changelog.html#change-1.9.14

Security issues fixed:

- CVE-2026-40011: invalid output produced in the prometheus endpoint when a large number of crafted DNS queries are sent
  (bsc#1269204).
- CVE-2026-40208: processing of DoH3 queries can be delayed via DoH3 GET queries with an invalid DATA frames
  (bsc#1269207).
- CVE-2026-40209: outgoing TCP connections to backend can get stuck until a timeout occurs when specially crafted IXFR
  queries are sent (bsc#1269206).
- CVE-2026-40210: out-of-bounds read when `SetMacAddrAction` is used can lead to uninitialized memory being sent over
  the network or a crash (bsc#1269205).
- CVE-2026-40211: crafted DNS over HTTP/3 queries can trigger an exception that prevents memory from being freed and can
  lead to an OOM condition (bsc#1269203).
- CVE-2026-42004: crafted EDNS OPT record will be ignored by filtering rules, but will be rewritten as a valid OPT
  record when EDNS Client Subnet is inserted (bsc#1269202).
- CVE-2026-42005: crafted web request can cause unlimited memory allocation in the internal web server and lead to a DoS
  (bsc#1269201).

Detailed information about Security update for dnsdist affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigation strat

Security update for dnsdist - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE Bug 1269201

SUSE Bug 1269202

SUSE Bug 1269203

SUSE Bug 1269204

SUSE Bug 1269205

SUSE Bug 1269206

SUSE Bug 1269207

SUSE CVE CVE-2026-40011 page

SUSE CVE CVE-2026-40208 page

SUSE CVE CVE-2026-40209 page

SUSE CVE CVE-2026-40210 page

SUSE CVE CVE-2026-40211 page

SUSE CVE CVE-2026-42004 page

SUSE CVE CVE-2026-42005 page

Security update for dnsdist

This update for rsyslog fixes the following issues:

- CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414).
- input sequence during oversize-frame recovery in imptcp can cause denial of service (bsc#1271910).

Changes for rsyslog:

- added a devel subpackage, with requires (bsc#1264721)

Detailed information about Security update for rsyslog affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigation strat

Security update for rsyslog - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE Bug 1264721

SUSE Bug 1271910

SUSE Bug 1272414

SUSE CVE CVE-2026-61548 page

Security update for rsyslog

This update for bouncycastle fixes the following issues:

Update to 1.85.

Security issues fixed:

- CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI (bsc#1272700).
- CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check (bsc#1272701).
- CVE-2026-12802: CMS AuthEnvelopedData fails to enforce tag-length on decryption (bsc#1272702).
- CVE-2026-12803: KCCMBlockCipher MAC does not bind nonce when AAD is absent (bsc#1272703).
- CVE-2026-12816: IESEngine stream-mode MAC forgery via length-dependent KDF split (bsc#1272704).
- CVE-2026-12817: OpenPGP AEAD decryption skips final tag on chunk-aligned data (bsc#1272705).
- CVE-2026-12852: MLS wire decoder allocates attacker-declared opaque length before bounds check (bsc#1272707).
- CVE-2026-12860: RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (bsc#1272708).
- CVE-2026-13506: Lazy ASN.1 sequence forcing resets nesting-depth guard (bsc#1272709).
- CVE-2026-13586: PKCS#12 MAC and bag-decryption KDF iteration-count bound (bsc#1272710).
- CVE-2026-14682: Possible OOM from unbounded up-front allocation on a definite-length read (bsc#1272711).
- CVE-2026-15055: PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (bsc#1272712).
- CVE-2026-58059: Quadratic-time escaping when stringifying X.500 distinguished names (bsc#1272713).
- CVE-2026-58060: HSS public-key level count unbounded, enabling huge allocation on verify (bsc#1272714).
- CVE-2026-58061: CCM-family modes write plaintext to caller buffer before tag check (bsc#1272715).
- CVE-2026-58062: Stapled OCSP response accepted without binding to the checked certificate (bsc#1272716).
- CVE-2026-58063: BCFKS keystore load honours unbounded KDF cost from untrusted file (bsc#1272717).
- CVE-2026-59638: JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (bsc#1272718).
- CVE-2026-59639: CMS verifySignatures returns true for SignedData with zero signers (bsc#1272719).
- CVE-2026-59640: OpenPGP CFB quick-check oracle active on symmetric/session-key paths (bsc#1272720).
- CVE-2026-59641: S/MIME validator trusts signer-asserted signingTime for path validation (bsc#1272721).
- CVE-2026-59642: CMS AuthenticatedData content not bound to MAC when authAttrs present (bsc#1272722).
- CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored (bsc#1272723).
- CVE-2026-59644: MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (bsc#1272724).
- CVE-2026-59645: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (bsc#1272725).
- CVE-2026-59646: DTLS handshake reassembler allocates buffer from unchecked 24-bit length (bsc#1272726).
- CVE-2026-59647: CRMF/CMP password-MAC honours unbounded iteration count (bsc#1272727).
- CVE-2026-59648: OpenPGP Argon2 S2K honours attacker-chosen memory and passes (bsc#1272728).
- CVE-2026-59649: OpenPGP user-attribute subpacket length bounded only by JVM max memory (bsc#1272729).
- CVE-2026-59650: MTI/A0 DH agreement exponentiates unvalidated peer value (bsc#1272730).
- CVE-2026-59651: BKS keystore accepts legacy version with 16-bit integrity MAC key (bsc#1272731).
- CVE-2026-59652: LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (bsc#1272732).

Additional notes:

- The standardised PQC algorithms ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, and CMCE have been repackaged under
  `org.bouncycastle.crypto` and the versions under `org.bouncycastle.crypto.pqc` have been deprecated. These deprecated
  versions will be removed in BC 1.86.

Detailed information about Security update for bouncycastle affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigation 

Security update for bouncycastle - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE Bug 1272700

SUSE Bug 1272701

SUSE Bug 1272702

SUSE Bug 1272703

SUSE Bug 1272704

SUSE Bug 1272705

SUSE Bug 1272707

SUSE Bug 1272708

SUSE Bug 1272709

SUSE Bug 1272710

SUSE Bug 1272711

SUSE Bug 1272712

SUSE Bug 1272713

SUSE Bug 1272714

SUSE Bug 1272715

SUSE Bug 1272716

SUSE Bug 1272717

SUSE Bug 1272718

Security update for bouncycastle

This update for nodejs22 fixes the following issues:

Update to 22.23.2.

- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-
  boundary checks (bsc#1272882).
- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
- CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
- CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Detailed information about Security update for nodejs22 affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigation stra

Security update for nodejs22 - Live Threat Intelligence - Threat Radar | OffSeq.com

SUSE Bug 1272882

SUSE Bug 1272941

SUSE Bug 1272942

SUSE Bug 1272943

SUSE Bug 1272944

SUSE Bug 1272945

SUSE Bug 1272947

SUSE Bug 1272948

SUSE Bug 1272949

SUSE Bug 1272950

SUSE Bug 1272951

SUSE CVE CVE-2026-54272 page

SUSE CVE CVE-2026-56846 page

SUSE CVE CVE-2026-56847 page

SUSE CVE CVE-2026-56848 page

SUSE CVE CVE-2026-56850 page

SUSE CVE CVE-2026-58039 page

SUSE CVE CVE-2026-58040 page

Security update for nodejs22

This update for python-ruff fixes the following issue:

- CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into
  terminal output after being logged (bsc#1249011).

Detailed information about Security update for python-ruff affecting SUSE Product Security Team SUSE. Get real-time updates, technical details, and mitigation s