SUSE-CU-2026:11649-1: Security update of suse/helm

Mon Oct 5 08:08:39 UTC 2026

SUSE Container Update Advisory: suse/helm
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:11649-1
Container Tags        : suse/helm:4 , suse/helm:4.3 , suse/helm:4.3.0 , suse/helm:4.3.0-70.1 , suse/helm:latest
Container Release     : 70.1
Severity              : important
Type                  : security
References            : 1261935 1261938 1261939 1265428 1265758 1270127 1271660 1271997
                        1275024 1275025 1276327 1276510 1276514 1279961 1281112 1281426
                        1281468 1281469 CVE-2026-33814 CVE-2026-35204 CVE-2026-35205
                        CVE-2026-35206 CVE-2026-41178 CVE-2026-41888 CVE-2026-48978 CVE-2026-50151
                        CVE-2026-50163 CVE-2026-56852 CVE-2026-56854 CVE-2026-56855 CVE-2026-56864
                        CVE-2026-56865 CVE-2026-78662 CVE-2026-81871 CVE-2026-81872 CVE-2026-85732
-----------------------------------------------------------------

The container suse/helm was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1790
Released:    Wed Sep 30 11:29:23 2026
Summary:     Recommended update for ca-certificates-mozilla
Type:        recommended
Severity:    moderate
References:  1279961
This update for ca-certificates-mozilla fixes the following issues:

Changes in ca-certificates-mozilla:

- Updated to 2.90 state (bsc#1279961):
    * Removed:
        +  AffirmTrust Commercial
        + AffirmTrust Networking
        + AffirmTrust Premium
        + AffirmTrust Premium ECC
        + certSIGN ROOT CA
        + Entrust Root Certification Authority
        + PKI Root Certification Authority
        + FIRMAPROFESIONAL CA ROOT-A WEB
        + GLOBALTRUST 2020
        + Secure Global CA
        + SecureSign Root CA12
        + SecureTrust CA
        + TeliaSonera Root CA v1
        + Trustwave Global Certification Authority
        + Trustwave Global ECC P256 Certification Authority
        + Trustwave Global ECC P384 Certification Authority
        + XRamp Global Certification Authority
    * Added:
        + SECOM SMIME RSA Root CA 2024
        + SECOM TLS ECC Root CA 2024
        + SECOM TLS RSA Root CA 2024
        + SecureSign Root CA16
        + Telia EC Email Root CA v3
        + Telia EC TLS Root CA v3
        + Telia RSA Email Root CA v3
        + Telia RSA TLS Root CA v3

-----------------------------------------------------------------
Advisory ID: 1794
Released:    Wed Sep 30 19:49:13 2026
Summary:     Security update for helm
Type:        security
Severity:    important
References:  1261935,1261938,1261939,1265428,1265758,1270127,1271660,1271997,1275024,1275025,1276327,1276510,1276514,1281112,1281426,1281468,1281469,CVE-2026-33814,CVE-2026-35204,CVE-2026-35205,CVE-2026-35206,CVE-2026-41178,CVE-2026-41888,CVE-2026-48978,CVE-2026-50151,CVE-2026-50163,CVE-2026-56852,CVE-2026-56854,CVE-2026-56855,CVE-2026-56864,CVE-2026-56865,CVE-2026-78662,CVE-2026-81871,CVE-2026-81872,CVE-2026-85732
This update for helm fixes the following issues:

- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
  (bsc#1265758).
- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin
  (bsc#1261939).
- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin
  provenance verification (bsc#1261935).
- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart
  (bsc#1261938).
- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length
  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled
  configuration (bsc#1265428).
- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to
  exfiltrate credentials and refresh tokens (bsc#1270127).
- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass
  allows log telemetry interception and alteration (bsc#1281468).
- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission
  (bsc#1281469).
- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network
  probing (bsc#1281112).
- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation
  (bsc#1276514).

The following package changes have been done:

- helm-4.3.0-160000.1.1 updated
- ca-certificates-mozilla-2.90-160000.1.1 updated
- container:bci-bci-base-16.0-b83d6d585765c2f6aacfa37676547be3e9c2c36fa6b0c7b3f8abdc9ff31f8310-0 updated
- container:registry.suse.com-bci-bci-micro-16.0-46b3f28a6ade6e6ff39d13ee8e50d3bd1b241d037b9702364dc35000188fbb36-0 updated