SUSE-SU-2026:2438-1

Опубликовано: 17 июн. 2026

Источник: suse-cvrf

Описание

Security update for alloy

This update for alloy fixes the following issues

Security issues:

CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).
CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Non security issue:

Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
Update to version 1.16.1

Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby

Use latest openSUSE Tumbleweed image for building web UI assets
Install nvm to set node version specified upstream
update to 1.16.0:

Features

Add clustering for loki.source.kubernetes_events (#6027) (3dbf587) (@petewall)
Add otelcol.auth.google client auth provider (#5526) (da99a66) (@dashpole, @clayton-cornell)
beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
database_observability: Add support for GCP Cloud SQL metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
database_observability: Make targets optional (#5924) (54664b2) (@matthewnolf)
database_observability: Update default excluded schemas and users (#6080) (b386fff) (@cristiangreco)
faro.receiver: Add sourcemap fetching from remote locations (#4614) (b6cb5da) (@Oxel40)
helm: Add support for global.image.pullPolicy (#6069) (2e2ce72) (@petewall)
helm: Allow configuring image pull policy for config reloader (#5923) (991539b) (@kalleep)
loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#5855) (053a2f7) (@kleimkuhler)
loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#5909) (c16a660) (@mikefat)
loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#5970) (b16decb) (@kleimkuhler)
Oracle exporter can scrape more than one DB (#6008) (6fbad38) (@ptodev)
prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#5836) (4f49b57) (@cristiangreco)
prometheus.remote_write: Sync WAL with upstream Prometheus (#5907) (e74a91b) (@x1unix)
pyroscope: Add support for extra async-profiler CLI arguments (#5472) (9251e33) (@ivanape)
pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
pyroscope: Update debuginfo client for HTTP/1.1 upload API (#6037) (879d8e5) (@korniltsev-grafanista)
Change service stop command from 'sc' to 'net' (#5906) (450973d) (@mateuszdrab)
database_observability.mysql: Refactor explain plan loop batch size (#5894) (f0fcd6b) (@cristiangreco)
database_observability.postgres: Cleanup embedded exporter collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
database_observability.postgres: Fix EXPLAIN param count when placeholders repeat (#6082) (b612b81) (@rgeyer)
database_observability: Drop schema_detection from logs (#6076) (b0105cb) (@cristiangreco)
database_observability: Ensure connection_info_monitor goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco)
deps: Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [SECURITY] (#6004) (38f4346)
deps: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (#5934) (a5154af)
deps: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (#6090) (0e59d64)
deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0 [SECURITY] (b44d51a) (@jharvey10)
deps: Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] (#6016) (d92c5c0) go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] (#6017) (e655bbc)
deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] (#6018) (94006e8)
deps: Update some minor go dep versions (#5896) (4ddd0ed) (@jharvey10)
go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8) (@x1unix)
go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix, @kalleep)
Helm: RBAC template handles empty rule arrays (#4860) (c9430e9) (@naptalie, @dehaansa, @kalleep)
loki.process: Eliminate per-stream goroutines in multiline stage (#6036) (c089e2e) (@kgeckhart)
loki.process: Prevent stage.structured_metadata from adding the same metadata several times (#5965) (0ec8a26) (@kalleep, @thampiotr)
loki.process: Wrap template in a custom type and move validation to syntax.Validator (#5910) (700dd7d) (@kalleep)
prometheus.exporter.postgres: Close DB connections on update (#6021) (8da97cf) (@kalleep)
prometheus.scrape: Update scrape_native_histograms to be updated at runtime (#6087) (18b205c) (@kalleep)
pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache (#5911) (03ca563) (@luweglarz)
pyroscope.ebpf: Move Pyroscope ebpf metrics registration after component error handling (#5540) (a3c57c0) (@crbednarz, @marcsanmi)
pyroscope: Set user agent on debuginfo connect-go client (#6022) (38ad1ef) (@korniltsev-grafanista)
ui: Large arguments are downloaded as files instead of rendered (#5268) (26c67b3) (@ptodev)
Update go-m1cpu v0.1.7 -> v0.2.1 to fix M5 chip crash (#6034) (7fa0cbc) (@ymotongpoo)
windows-installer: Increase service restart on failure delays (#5969) (add15b1) (@rknightion)
add script to package webassets inside a podman container, to not endanger or pollute the host system with npm
update to 1.15.1: goroutine exits on Stop

CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955)

update to 1.15.0:

BREAKING CHANGES

otelcol: Upgrade to OTel Collector v0.147.0
Renamed undocumented metrics that was previously prefixed with <component_id><metric_name> to loki_source_awsfirehose<metric_name>

Security CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1 (bsc#1258609).

alloy-mixin: Add filters, groupBy, and multi-select dashboard variables
beyla.ebpf: Add support for Prometheus native histograms
beyla.ebpf: Bump Beyla to v3.6
converters: Support converting Promtail limits_config
database_observability.mysql: Add filtering of query samples and wait events by minimum duration
database_observability.mysql: Embed prometheus exporter within db-o11y component
database_observability.postgres: Add configurable limit to pg_stat_statements query
database_observability.postgres: Embed prometheus exporter
database_observability: Promote components to stable
Expose Functionality to Handle syslogs with Empty MSG Field
loki.process: Support structured metadata as source type of stage.labels for loki.process
loki.secretfilter: Add sampling for secretfilter entries
loki.source.gcplog: Add alloy config for MaxOutstandingBytes and MaxOutstandingMessages
loki.write: Add loki pipeline latency metric
mixin: Update loki dashboard
otelcol.receiver.datadog: Expose intake proxy and trace_id_cache_size settings
prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default
pyroscope.ebpf: Add comm, pid labels and kernel frame options
update to 1.14.1:
Correctly handle the deprecated topic field in otelcol.receiver.kafka configuration
loki.process: Protect against json that does not look like docker json format
loki.source.file: Keep positions for compressed files when reading is finished
prometheus.scrape: Update arguments and targets even if scrape_native_histograms and extra_metrics are updated
update to 1.14.0:
loki.secretfilter: Some config options are removed entirely: partial_mask (replaced with redact_percent), allowlist (now controlled with custom gitleaks config), enable_entropy, include_generic, types (now controlled with custom gitleaks config).
otelcol.receiver.prometheus: otelcol.receiver.prometheus no longer sets start times of OTLP metrics.

Security:

update to 1.13.2:
Expose missing otelcol.processor.tail_sampling options
mixin: Add zipped dashboards as a release artifact
profiler: Backport Go 1.26 gopclntab textStart fix
prometheus.exporter.postgres: Update version of the exporter fork to fix pg_settings
pyroscope.ebpf: Backport dotnet nibble map fix
update to 1.13.1:
timeout before starting new ones
update to 1.13.0:
otelcol: Upgrade to OTel Collector v0.142.0
otelcol.receiver.kafka: The global topic attribute has been deleted; use the topics attributes inside the logs, metrics, and traces blocks instead.
otelcol.exporter > sending_queue > batch > min_size changed from 8192 to 2000 and max_size changed from 0 to 3000
Add a virtual_node_peer_attributes and virtual_node_extra_label arguments to otelcol.connector.servicegraph
Add an otelcol.processor.metric_start_time component
Add job level period, length, and add_cloudwatch_timestamp options and labels_snake_case to CW exporter
Add missing configuration parameter deployment_name_from_replicaset to k8sattributes processor
Add parcas symbols upload to pyroscope.ebpf
Add sharding for loki.write
Add unexposed otel engine and extension to codebase and change build structure
beyla.ebpf: Add meta_cache_address to beyla.ebpf.attributes.kubernetes
beyla.ebpf: Upgrade Beyla to v2.8.5
Change the defaults for sending_queue > batch block inside otelcol.exporter components
cluster: Support DNS discovery mode prefixes in --cluster.join-addresses flag
converter: Update promtail converter to use file_match block for loki.source.file
database_observability: Add health check collector for postgres component
database_observability: Expose exclude_schemas and exclude_databases settings
database_observability: Support Azure cloud provider config data
database_observability.mysql: Support excluding schemas in all collectors
database_observability.postgres: Support excluding DBs in all collectors

Список пакетов

SUSE Linux Enterprise Module for Basesystem 15 SP7

alloy-1.16.1-150700.15.20.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20262438-1/
Link for SUSE-SU-2026:2438-1
https://lists.suse.com/pipermail/sle-updates/2026-June/047406.html
E-Mail link for SUSE-SU-2026:2438-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1258099
SUSE Bug 1258099
https://bugzilla.suse.com/1258609
SUSE Bug 1258609
https://bugzilla.suse.com/1259919
SUSE Bug 1259919
https://bugzilla.suse.com/1260317
SUSE Bug 1260317
https://bugzilla.suse.com/1262955
SUSE Bug 1262955
https://bugzilla.suse.com/1263530
SUSE Bug 1263530
https://www.suse.com/security/cve/CVE-2026-25934/
SUSE CVE CVE-2026-25934 page
https://www.suse.com/security/cve/CVE-2026-26958/
SUSE CVE CVE-2026-26958 page
https://www.suse.com/security/cve/CVE-2026-33186/
SUSE CVE CVE-2026-33186 page
https://www.suse.com/security/cve/CVE-2026-34986/
SUSE CVE CVE-2026-34986 page
https://www.suse.com/security/cve/CVE-2026-41602/
SUSE CVE CVE-2026-41602 page
https://www.suse.com/security/cve/CVE-2026-4427/
SUSE CVE CVE-2026-4427 page

Описание

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.