This security update for SUSE's docker-compose package addresses multiple vulnerabilities including credential leakage to telemetry endpoints, denial of service during SSH key exchange, an infinite loop in HTTP/2 transport, and a validation bypass that could allow privilege escalation. The affected versions are specific SUSE docker-compose packages on aarch64 and ppc64le architectures. The update fixes CVE-2025-0495, CVE-2025-22869, CVE-2026-33814, and CVE-2026-39821. These issues have been classified as high severity.
Multiple security vulnerabilities have been identified and fixed in the jq tool by the SUSE Product Security Team. These include heap buffer overflows, integer overflows, unbounded recursion leading to resource exhaustion, missing runtime type checks causing crashes, out-of-bounds reads, denial of service via resource exhaustion, memory corruption, and validation bypass. The vulnerabilities affect jq version 1.7.1-160000.3.1.aarch64. No known exploits in the wild have been reported.
A security update has been recommended for the SUSE packages mpv, libKPipeWireRecord6, and ffmpegthumbs-kf5 to address unspecified vulnerabilities. The update aims to fix multiple issues, though specific technical details and affected versions are not provided.
This update for apache2 fixes the following issues
- CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
- CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
- CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
- CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
- CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
- CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
- CVE-2026-43951: out-of-bound read in `merge_response_headers` can cause crash (bsc#1267963).
- CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
- CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (bsc#1267969).
- CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of
service (bsc#1267970).
- CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
- CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free
(bsc#1267972).
- CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).
A NULL pointer dereference vulnerability (CVE-2025-70102) exists in the parse_option() function of dhcpcd. This vulnerability is addressed in dhcpcd version 10.3.2, which includes multiple fixes to improve stability and security by preventing NULL dereferences and handling DHCP state more robustly.
A heap buffer overflow vulnerability exists in the 'pairwise' function of perl-List-SomeUtils-XS. This issue is identified as CVE-2026-12844 and has been addressed by a security update from the SUSE Product Security Team. The vulnerability is rated as high severity. No specific affected versions are provided in the available data.
A security update for jline3 addresses an unauthenticated remote memory exhaustion vulnerability caused by unbounded Telnet 'NEW-ENVIRON' variables. This flaw could allow an attacker to exhaust memory resources remotely without authentication. The issue is rated medium severity. No specific affected versions or patch details are provided in the available data.
This security update for cadvisor addresses multiple issues through a series of incremental version updates culminating in version 0.60.3. The updates include improvements in OOM watching, enhanced cgroup v2 memory metrics exposure, fixes for container handler tests, and resolution of a nil pointer dereference in Docker integration. Several dependencies were also updated to address security vulnerabilities, including a bump of x/net to 0.55. The update fixes known bugs and improves stability and metrics reporting for container environments.
Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.
Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.
This update for gstreamer-plugins-good fixes the following issues:
- CVE-2026-53705: wavpackdec: Avoid integer overflow when calculating output buffer size and related fixes (bsc#1268449).
A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive data into logfiles, allowing local attackers to misuse respective gained data or credentials.
A reflected DOM cross-site scripting (XSS) vulnerability (CVE-2025-11687) was identified and fixed in the python-gi-docgen component by the SUSE Product Security Team. The vulnerability affects SUSE Linux Enterprise and openSUSE Leap 16.0 versions of gi-docgen. No CVSS score is provided, but the issue is rated medium severity. No explicit patch or remediation details are provided in the input data.
A security update for rmt-server addresses CVE-2026-42256, which involves a denial-of-service (DoS) vulnerability when a client authenticates using SCRAM-SHA1 or SCRAM-SHA2 against a hostile IMAP server. The update to version 3.0.0 removes unused ActionMailer/ActionMailbox components to eliminate this vulnerability and improves security by splitting the Rails meta-gem into individual components.
A security update for golang-github-docker-libnetwork addresses CVE-2026-2808, which involves unvalidated user-supplied file paths in github.com/hashicorp/consul. This vulnerability can lead to arbitrary file reads through the Vault Kubernetes authentication provider. The issue was identified and fixed by the SUSE Product Security Team. No specific affected versions are provided. No known exploits are reported in the wild. The severity is assessed as medium.
This security update for systemd addresses multiple issues including improved handling of TLS allocation failures, disabling mounting of debugfs by default, and several fixes related to systemd-update-helper and package management. It also includes changes to runtime dependencies and package structuring. The update is classified as high severity.
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.
A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services
CVE-2026-29181 is a denial of service vulnerability in OpenTelemetry-Go, the Go implementation of OpenTelemetry. An attacker can exploit this flaw by sending multiple crafted 'baggage' HTTP header lines, causing excessive CPU and memory consumption. This vulnerability affects the multicluster engine for Kubernetes and related components, potentially rendering services unavailable. The issue is addressed in the etcd-3.6.13-1.1 package on openSUSE Tumbleweed and is relevant to certain SUSE product versions. The vulnerability is rated medium severity.