Описание
Security update for alloy
This update for alloy fixes the following issues:
- CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861).
- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742).
- CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482).
- CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483).
- CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484).
- CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486).
- CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled
writevbuffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487). - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418).
- CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028).
- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671).
- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982).
- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992).
- CVE-2026-75889: arbitrary file reads due to the
prometheus.operator.servicemonitorscomponent allowing users who can modifyServiceMonitorresources in a watched namespace to specify an arbitrary local file throughbearerTokenFile(bsc#1277429). - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693).
- CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671).
Changes for alloy:
- Update to version 1.19.2.
- Update to version 1.19.1.
- Update to version 1.19.0:
- BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior.
- prometheus.enrich: Support multi-label matching
- prometheus.relabel: Add opt-in TTL cache mode
- telemetry: Add new metrics for graph connections and pyroscope forwarded entries
- database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans
- Update to version 1.18.1:
- Add nop receiver to OTel Engine
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
Ссылки
- Link for SUSE-SU-2026:4408-1
- E-Mail link for SUSE-SU-2026:4408-1
- SUSE Security Ratings
- SUSE Bug 1267482
- SUSE Bug 1267483
- SUSE Bug 1267484
- SUSE Bug 1267486
- SUSE Bug 1267487
- SUSE Bug 1268982
- SUSE Bug 1269861
- SUSE Bug 1272028
- SUSE Bug 1272418
- SUSE Bug 1276742
- SUSE Bug 1276982
- SUSE Bug 1276992
- SUSE Bug 1277429
- SUSE Bug 1277996
- SUSE Bug 1278671
- SUSE Bug 1278693
- SUSE Bug 1280671
Описание
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
Затронутые продукты
Ссылки
- CVE-2026-2303
- SUSE Bug 1268652
Описание
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
Затронутые продукты
Ссылки
- CVE-2026-37236
- SUSE Bug 1277941
Описание
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-41178
- SUSE Bug 1276509
Описание
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.
Затронутые продукты
Ссылки
- CVE-2026-45679
- SUSE Bug 1267482
Описание
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0.
Затронутые продукты
Ссылки
- CVE-2026-45680
- SUSE Bug 1267483
Описание
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.
Затронутые продукты
Ссылки
- CVE-2026-45681
- SUSE Bug 1267484
Описание
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.
Затронутые продукты
Ссылки
- CVE-2026-45683
- SUSE Bug 1267486
Описание
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.
Затронутые продукты
Ссылки
- CVE-2026-45684
- SUSE Bug 1267487
Описание
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Затронутые продукты
Ссылки
- CVE-2026-46600
- SUSE Bug 1272415
Описание
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-48496
- SUSE Bug 1268982
Описание
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Затронутые продукты
Ссылки
- CVE-2026-56852
- SUSE Bug 1271661
- SUSE Bug 1280553
Описание
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Затронутые продукты
Ссылки
- CVE-2026-56854
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Затронутые продукты
Ссылки
- CVE-2026-56855
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Затронутые продукты
Ссылки
- CVE-2026-71556
- SUSE Bug 1276977
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-71557
- SUSE Bug 1276986
Описание
Grafana Alloy's prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy's Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy's service account.
Затронутые продукты
Ссылки
- CVE-2026-75889
- SUSE Bug 1277429
Описание
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
Затронутые продукты
Ссылки
- CVE-2026-78662
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.
Затронутые продукты
Ссылки
- CVE-2026-81521
- SUSE Bug 1278693
Описание
An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.
Затронутые продукты
Ссылки
- CVE-2026-89090
- SUSE Bug 1280622