SUSE Product Security Team vulnerabilities and threats

A security update for Botan addresses a critical client authentication bypass vulnerability in the TLS 1.3 implementation identified as CVE-2026-34582. This flaw could allow an attacker to bypass client authentication during TLS 1.3 sessions. The update fixes this issue to restore proper authentication enforcement.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl threads have a working directory race condition where file operations may target unintended paths (CVE-2025-40909) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This security update for python-Django addresses multiple vulnerabilities including ASGI header spoofing, privilege abuse in admin components, and potential denial-of-service issues related to file uploads and memory limits. These flaws could allow attackers to spoof headers, abuse privileges in the Django admin interface, or cause denial-of-service conditions via crafted requests. The update fixes these issues to improve the security posture of Django applications.

A security update for python-Flask-HTTPAuth addresses a vulnerability identified as CVE-2026-34531, which involves the acceptance of empty tokens. This issue has been fixed by disallowing empty tokens in authentication processes. The vulnerability is rated with medium severity. No specific affected versions are provided in the available data.

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279) * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269) * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275) * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 140.9.1 ESR (bsc#1261663). - MFSA 2026-27: * CVE-2026-5731: memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2. * CVE-2026-5732: incorrect boundary conditions, integer overflow in the Graphics: Text component. * CVE-2026-5734: memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2.

A security update for pcre2 addresses CVE-2025-58050, which is an integer overflow vulnerability causing a heap buffer overread in the match_ref function due to missing boundary restoration in SCS. This vulnerability has been assigned a medium severity level.

This security update for SUSE's cockpit-machines addresses two denial-of-service vulnerabilities: CVE-2026-25547, caused by unbounded brace range expansion in the brace-expansion library leading to excessive resource consumption and potential Node.js process crashes; and CVE-2026-26996, a Regular Expression Denial of Service (ReDoS) vulnerability in minimatch when processing certain glob patterns with repeated wildcards. The update fixes these issues in specific cockpit package versions for the aarch64 architecture.

A medium severity security update for ovmf addresses CVE-2025-59438, a padding oracle attack vulnerability in mbedtls. This vulnerability allows an attacker to exploit timing differences in cipher error reporting to potentially decrypt data. No specific affected versions or patch details are provided in the input data.

This update for python-gi-docgen fixes the following issues: - CVE-2025-11687: Fixed reflected DOM XSS (bsc#1251961)

A buffer overflow vulnerability (CVE-2026-3172) exists in the parallel HNSW index build of pgvector, fixed in version 0.8.2. This update also addresses issues with index searches in EXPLAIN output for Postgres 18.

A security update for perl-Authen-SASL addresses CVE-2025-40918 by changing nonce generation to use Crypt::URandom. This update fixes a vulnerability related to nonce generation in the perl-Authen-SASL module. No specific affected versions are stated. The severity is assessed as medium.

This update for patterns-glibc-hwcaps addresses issues by moving the pattern from PackageHub to regular SLES and requires packages optimized for the x86_64 v3 architecture. These packages are automatically included when this architecture is present to improve performance.

A reachable assertion vulnerability (CWE-617) in ISC Kea DHCP daemons (kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, kea-dhcp6) allows a denial of service via a stack overflow triggered by a maliciously crafted message sent over any configured API socket or HA listener. This affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2. Red Hat has issued security advisories and updates to address this issue.

This update for aws-c-event-stream fixes the following issues: Changes in aws-c-event-stream: - CVE-2026-5190: Fixed a out-of-bounds write caused by crafted event-stream messages (bsc#1261298)

A medium severity security update for MapServer addresses multiple issues, including a fix for a potential heap buffer overflow in the msSLDParseRasterSymbolizer component. This vulnerability, identified as CVE-2026-33721, affects MapServer versions prior to 8.6.1. Updating to version 8.6.1 resolves this vulnerability along with other fixes and feature enhancements.

A security update for tigervnc addresses a vulnerability identified as CVE-2026-34352. The issue involved improper permissions that could allow unauthorized users to observe the screen or modify data sent to the client. This update fixes these permission issues to prevent such unauthorized access or modification.

A security update for osslsigncode addresses multiple vulnerabilities including integer overflows, double-free issues, and memory corruption in APPX and PE file processing. The update also includes fixes for buffer overflows during message digest extraction and improvements in certificate validation and CRL handling. These issues are fixed in osslsigncode version 2.13.