SUSE-CU-2026:13838-1: Security update of suse/registry

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/registry
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13838-1
Container Tags        : suse/registry:3.1 , suse/registry:3.1 , suse/registry:3.1-80.10 , suse/registry:latest
Container Release     : 80.10
Severity              : critical
Type                  : security
References            : 1247539 1274235 1274237 1274850 1274852 1274854 CVE-2025-49506
                        CVE-2026-32327 CVE-2026-34191 CVE-2026-34501 CVE-2026-34502 
-----------------------------------------------------------------

The container suse/registry was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 4
Released:    Tue Oct 27 18:00:02 2026
Summary:     Security update for apr-util
Type:        security
Severity:    critical
References:  1247539,1274235,1274237,1274850,1274852,1274854,CVE-2025-49506,CVE-2026-32327,CVE-2026-34191,CVE-2026-34501,CVE-2026-34502
This update for apr-util fixes the following issues:

- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
- CVE-2026-32327: XML stack recursion crash (bsc#1274235).
- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).


The following package changes have been done:

- libapr-util1-0-1.6.3-160100.3.1 updated