Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:22026-1

Опубликовано: 06 окт. 2026
Источник: suse-cvrf

Описание

Security update for prometheus-blackbox_exporter

This update for prometheus-blackbox_exporter fixes the following issues:

Changes in prometheus-blackbox_exporter:

  • CVE-2026-84304: Fix heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 (bsc#1279126)

  • CVE-2026-39821: Fix potential validation bypass and privilege escalation by bumping golang.org/x/net to version 0.57.0 (bsc#1266556)

  • CVE-2026-39821: Bump golang.org/x/net to version 0.55.0 (bsc#1266556)

  • Build only for SUSE distributions

  • Upgrade to version 0.26.0 (jsc#PED-12872):

    • Changes: Replace go-kit/log with log/slog module.
    • Features: Add metric to record tls ciphersuite negotiated during handshake. Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
    • Enhancement: Add stale workflow to start sync with stale.yaml in Prometheus.
    • Bug fixes: Only register grpc TLS metrics on successful handshake.

  • Upgrade to version 0.25.0:

    • Features: Allow to get Probe logs by target. Log errors from probe.
    • Bug fixes: Prevent logging confusing error message. Explicit registration of internal exporter metrics.

  • Security:

    • CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238680)
    • CVE-2023-45288: Fix closing connections when receiving too many headers (bsc#1236515)

Список пакетов

openSUSE Leap 16.0
prometheus-blackbox_exporter-0.26.0-bp160.1.1

Ссылки

Описание

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Затронутые продукты
openSUSE Leap 16.0:prometheus-blackbox_exporter-0.26.0-bp160.1.1
Ссылки

Описание

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Затронутые продукты
openSUSE Leap 16.0:prometheus-blackbox_exporter-0.26.0-bp160.1.1
Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:prometheus-blackbox_exporter-0.26.0-bp160.1.1
Ссылки

Описание

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

Затронутые продукты
openSUSE Leap 16.0:prometheus-blackbox_exporter-0.26.0-bp160.1.1
Ссылки
Уязвимость openSUSE-SU-2026:22026-1