SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error...

SUSE-SU-2026:4408-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST reque...

Security update for alloy

This update for alloy fixes the following issues: CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: tempo, aws-otel-collector, amazon-cloudwatch-agent, opentofu, grafana-alloy, fluent-bit-plugin-loki, grafana, datadog-agent, distribution, kots, mcp-grafana, harbor-registry, pulumi-kubernetes-operator, loki, zot, falcosidekick, grafana-mimir, caddy, grafana-pyroscop...

CLEANSTART-2026-CI21288 vulnerability has been found in cilium ebpf up to 0

Security vulnerability affects the grafana-alloy package. A vulnerability has been found in cilium ebpf up to 0...

CLEANSTART-2026-TI06135 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the grafana-alloy package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

SUSE SLES16 Security Update : alloy (SUSE-SU-2026:23865-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23865-1 advisory. - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:21899-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21899-1 advisory. - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs...

Security update for alloy (important)

openSUSE security update: security update for alloy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21899-1 Rating: important References: bsc1263289 bsc1263324 bsc1264949 bsc1265542 bsc1265845 bsc1266654 Cross-References: CVE-2026-10722 CVE-2026-122...

OPENSUSE-SU-2026:21899-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

SUSE-SU-2026:23853-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

SUSE-SU-2026:23865-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

alloy-1.19.2-1.1 on GA media (moderate)

alloy-1.19.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11803-1 Rating: moderate Cross-References: CVE-2026-2303 CVE-2026-37236 CVE-2026-41178 CVE-2026-45679 CVE-2026-45680 CVE-2026-45681 CVE-2026-45683 CVE-2026-45684 CVE-2026-46600 CVE-2026-48496 CVE-2026-56852 CVE-2026-56854 CVE-2026-715...

CLEANSTART-2026-LL04438 Security fix for CVE-2026-33762 applied in: argo-cd 3.2.7-r2, argo-cd 3.3.5-r2, argo-cd-fips 3.1.14-r0, argo-cd-fips 3.2.9-r0, external-secrets-fips 0.17.0-r2, flux-image-automation-controller-fips 4.0.1-r0, gitlab-runner 18.11.1-r0, gptscript 0.9.8-r0, grafana-alloy 1.13.1-r1, grafana-alloy 1.14.0-r1, grafana-alloy 1.14.1-r1, grafana-alloy 1.14.2-r0, grafana-alloy 1.15.0-r0, grafana-alloy 1.16.0-r0, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-alloy-fips 1.16.0-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 2.7.0-r0, syft 1.42.4-r0, timoni 0.25.2-r0

CVE-2026-33762 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4

CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GW50856 Security fix for CVE-2026-33997 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300069.0-r1, gitlab-runner 18.11.1-r0, grafana-alloy 1.14.2-r2, grafana-alloy 1.15.0-r0, grafana-alloy 1.15.1-r1, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-alloy-fips 1.15.1-r0, k8ssandra-client-fips 0.6.4-r7, k8ssandra-client-fips 0.7.0-r5, melange 0.55.0-r1, melange 0.56.1-r1, paranoia 0.2.1-r0, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, promxy 0.0.93-r1, pulumi 3.299.0-r0, rancher-agent 2.11.15-r1, spire-server-fips 1.15.1-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1

CVE-2026-33997 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AX54814 Security fix for CVE-2025-11579 applied in: gptscript 0.6.0-r0, gptscript 0.7.1-r0, gptscript 0.8.5-r0, grafana-alloy 1.14.2-r2, grafana-alloy 1.15.0-r0, grafana-alloy 1.16.0-r0, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0

CVE-2025-11579 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZS27491 Security fix for CVE-2026-21726 applied in: grafana-alloy 1.15.1-r1, grafana-alloy 1.16.0-r0, grafana-alloy-fips 1.14.2-r1, grafana-alloy-fips 1.15.0-r2, grafana-alloy-fips 1.15.1-r0, grafana-alloy-fips 1.16.0-r0

CVE-2026-21726 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QJ20877 Security fix for CVE-2026-4878 applied in: grafana-alloy 1.15.0-r2

Security vulnerability affects the grafana-alloy package. This issue is resolved in later releases. See references for vulnerability details...