Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.182 fixes various security issues: The following security issues were fixed: CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd bsc1272391. CVE-2026-63920: ipv6: validate extension header...

Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd Patch Instructions: To install this SUSE update use the SUSE recommended installation...

Security update for valkey

This update for valkey fixes the following issue: CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: CVE-2026-78807: missing validation in driver-based PMKSA selection within wpasupplicant can allow local security bypasses bsc1280914. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for valkey

This update for valkey fixes the following issue: CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and...

Security update for the Linux Kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.25 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283...

Security update for pcre2

This update for pcre2 fixes the following issues: CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. CVE-2026-89157: out-of-bounds write via large pattern...

Security update for rpm

This update for rpm fixes the following issue: Security issues fixed: CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584. Other updates and bugfixes: Fix libelf handle not being closed, resulting in build errors...

Security update for sssd

This update for sssd fixes the following issues: CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed bsc1273925. CVE-2026-12610: cancelled or completed PAM request while the asynchronous...

Security update for cups

This update for cups fixes the following issue: CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure bsc1263116. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for rpcbind

This update for rpcbind fixes the following issue: CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issue: CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements bsc1275199. Patch Instructions: To install this SUSE update use the SUSE...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues: CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1279252. CVE-2026-84304:...

Security update for python-msgpack

This update for python-msgpack fixes the following issue CVE-2026-57585: Unpacker reuse after a caught error can lead to an out-of-bounds read and a crash bsc1269947. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. CVE-2026-88816: numeric value incorrectly treated as strings in FetchHashKeyName allows for process crash bsc1283056. Patch...

Security update for kubevirt-1.6

This update for kubevirt-1.6 fixes the following issues: Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place and then execs qemu-pr-helper. Only...

Security update for suseconnect-ng

This update for suseconnect-ng fixes the following issue: Update version to 1.23.0: Use product identifier for product migrations. bsc1268596 Switch to using go1.26-openssl as the default Go version to install to support building the package jscSCC-843, bsc1268900. Fix flag parsing so that unknow...

Security update for the Linux Kernel (Live Patch 76 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.290 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free i...

Security update for the Linux Kernel (Live Patch 74 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free i...

Security update for the Linux Kernel RT (Live Patch 20 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.75 fixes one security issue: The following security issue was fixed: CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment bsc1277506. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for the Linux Kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd bsc1272391. CVE-2026-63920: ipv6: validate extension header leng...

Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.67 fixes various security issues: The following security issues were fixed: CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283. CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextc...

Security update for the Linux Kernel RT (Live Patch 15 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.54 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issue: CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset bsc1280587. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for helm

This update for helm fixes the following issues: CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal...

Security update for python-anyio

This update for python-anyio fixes the following issues: CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475. Patch Instructions: To install...

Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.44 fixes various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted bsc1280590. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

Security update for python

This update for python fixes the following issues: CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15806:...

Security update for libX11

This update for libX11 fixes the following issues: CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow bsc1280910. CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser bsc1281653. CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM...

Security update for gimp

This update for gimp fixes the following issues: CVE-2026-18301: Vulnerability Report at readchanneldata bsc1276230. CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow bsc1276231. CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow bsc1276232. CVE-2026-18304: TIF File Parsing...

Security update for alloy

This update for alloy fixes the following issues: CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request...

Security update for jawn

This update for jawn fixes the following issue: CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustion bsc1282548. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for multipath-tools

This update for multipath-tools fixes the following issues: Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. Path traversal in device-mapper-multipath failedwwids management bsc1277210. SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows bsc127721...

Security update for wicked2nm

This update for wicked2nm fixes the following issue: serdewith: KeyValueMap serialization panics on empty sequence or map entries bsc1271848. Changes for wicked2nm: Update v1.5.2. Update v1.5.1: Update agama to fix default vlan flags bsc1271079. Patch Instructions: To install this SUSE update use...

Security update for python-tornado

This update for python-tornado fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClien...

Security update for python-tornado6

This update for python-tornado6 fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClie...

Security update for python-PyYAML

This update for python-PyYAML fixes the following issues: Update to 5.3.1. CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader...

Security update for python313

This update for python313 fixes the following issues: Security issues fixed: CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974...

Security update for gdb

This update for gdb fixes the following issue: CVE-2026-13732: Out-of-bounds write in STABS parser readmemberfunctions via crafted ELF bsc1277757. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively...

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3gntfsprogs fixes the following issues: Denial-of-service in ntfsinodeattachallextents bsc1281758. Heap buffer overflow in ntfsaclowner bsc1281756. Heap buffer overflow in ntfscheckrestartarea bsc1281759. Heap buffer overflow in ntfseacheckwsldev bsc1281760. Heap buffer...

Security update for python-pymongo

This update for python-pymongo fixes the following issues: CVE-2026-96747: improper handling of key management endpoint values ending in .sock allows users with write access to the encryption key metadata to open connections to local sockets on the application host bsc1282844. CVE-2026-96748: hos...

Security update for libXrender

This update for libXrender fixes the following issue: CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow bsc1280911. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can r...

Security update for python311

This update for python311 fixes the following issues: CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL...

Security update for libXrender

This update for libXrender fixes the following issue: CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow bsc1280911. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can r...

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...