SUSE-CU-2026:12091-1: Security update of suse/multi-linux-manager/5.2/x86_64/server-attestation
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Oct 9 09:14:16 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.2/x86_64/server-attestation
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12091-1
Container Tags : suse/multi-linux-manager/5.2/x86_64/server-attestation:5.2.1 , suse/multi-linux-manager/5.2/x86_64/server-attestation:5.2.1.11.5.1 , suse/multi-linux-manager/5.2/x86_64/server-attestation:latest
Container Release : 11.5.1
Severity : important
Type : security
References : 1208800 1212476 1216950 1226112 1227370 1230568 1230949 1236136
1236165 1236599 1239009 1242233 1243014 1243459 1243564 1243830
1247463 1250233 1250234 1252286 1252306 1252696 1253025 1253043
1256829 1256831 1256832 1256833 1257151 1257274 1257463 1258311
1258382 1258500 1258567 1259225 1259652 1259825 1260342 1261400
1261678 1261982 1261983 1262157 1262305 1262315 1262684 1262698
1262701 1263656 1263658 1263822 1264396 1264994 1264994 1265219
1265472 1266262 1266263 1266343 1266344 1266347 1266481 1266786
1267261 1267355 1267610 1267644 1267647 1267871 1267912 1268228
1268325 1268473 1268587 1268603 1268673 1268755 1268853 1268867
1268897 1268898 1268899 1268902 1268902 1269192 1269253 1269316
1269534 1269679 1270033 1270039 1270040 1270047 1270141 1270527
1270541 1270642 1270694 1270720 1270799 1270873 1270947 1271075
1271116 1271124 1271329 1271332 1271382 1271440 1271442 1271467
1271523 1271649 1271678 1271681 1271712 1271841 1271902 1271963
1272223 1272224 1272225 1272227 1272228 1272235 1272236 1272237
1272298 1272392 1272404 1272538 1272621 1272772 1272773 1272774
1272988 1273073 1273131 1273144 1273243 1273846 1273853 1273856
1273857 1274023 1274227 1274613 1274720 1274723 1274726 1274774
1274775 1274777 1274788 1274790 1274791 1274792 1274795 1274796
1274797 1274798 1274867 1275035 1275660 1275764 1275777 1275778
1275837 1276892 1276946 1277247 1277262 1277707 1277708 1277709
1277710 1277711 1277713 1277883 1277921 1277922 1278001 1278008
1279863 1279893 1280050 1280051 1280052 1280053 1280054 1280125
1280587 1280589 1280590 1280591 1280592 1280594 1280595 1280596
1280597 1280598 1280599 1281125 1282491 1282492 1282505 1282639
1282640 1282641 1282645 CVE-2024-12797 CVE-2024-13176 CVE-2024-9143
CVE-2025-11187 CVE-2025-15468 CVE-2025-15469 CVE-2025-27587 CVE-2025-4575
CVE-2025-66199 CVE-2025-9231 CVE-2025-9232 CVE-2026-14456 CVE-2026-14457
CVE-2026-16349 CVE-2026-16350 CVE-2026-16351 CVE-2026-16352 CVE-2026-16353
CVE-2026-16354 CVE-2026-16355 CVE-2026-16356 CVE-2026-16357 CVE-2026-16358
CVE-2026-16359 CVE-2026-16360 CVE-2026-16362 CVE-2026-16363 CVE-2026-16364
CVE-2026-16365 CVE-2026-16366 CVE-2026-16367 CVE-2026-16368 CVE-2026-16369
CVE-2026-16370 CVE-2026-16371 CVE-2026-16372 CVE-2026-16373 CVE-2026-16374
CVE-2026-16375 CVE-2026-16376 CVE-2026-16377 CVE-2026-16378 CVE-2026-16379
CVE-2026-16380 CVE-2026-16381 CVE-2026-16382 CVE-2026-16383 CVE-2026-16384
CVE-2026-16385 CVE-2026-16386 CVE-2026-16387 CVE-2026-16388 CVE-2026-16389
CVE-2026-16390 CVE-2026-16391 CVE-2026-16392 CVE-2026-16393 CVE-2026-16394
CVE-2026-16395 CVE-2026-16396 CVE-2026-16397 CVE-2026-16398 CVE-2026-16399
CVE-2026-16400 CVE-2026-16401 CVE-2026-16402 CVE-2026-16403 CVE-2026-16404
CVE-2026-16405 CVE-2026-16406 CVE-2026-16407 CVE-2026-16408 CVE-2026-16409
CVE-2026-16410 CVE-2026-16411 CVE-2026-16412 CVE-2026-18374 CVE-2026-18401
CVE-2026-18798 CVE-2026-19032 CVE-2026-19499 CVE-2026-19542 CVE-2026-2673
CVE-2026-28390 CVE-2026-34181 CVE-2026-34182 CVE-2026-35189 CVE-2026-35191
CVE-2026-39821 CVE-2026-40226 CVE-2026-41254 CVE-2026-41254 CVE-2026-41677
CVE-2026-41678 CVE-2026-41681 CVE-2026-41898 CVE-2026-41989 CVE-2026-42250
CVE-2026-42327 CVE-2026-42764 CVE-2026-44662 CVE-2026-45784 CVE-2026-46917
CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059
CVE-2026-47063 CVE-2026-5435 CVE-2026-54369 CVE-2026-54370 CVE-2026-54371
CVE-2026-54512 CVE-2026-54513 CVE-2026-54514 CVE-2026-54515 CVE-2026-54515
CVE-2026-54872 CVE-2026-54874 CVE-2026-54875 CVE-2026-56109 CVE-2026-59888
CVE-2026-59889 CVE-2026-60147 CVE-2026-60589 CVE-2026-61308 CVE-2026-6238
CVE-2026-63007 CVE-2026-63009 CVE-2026-63072 CVE-2026-63073 CVE-2026-63074
CVE-2026-63075 CVE-2026-63076 CVE-2026-6368 CVE-2026-6791 CVE-2026-68494
CVE-2026-68495 CVE-2026-68496 CVE-2026-68497 CVE-2026-68498 CVE-2026-70907
CVE-2026-71400 CVE-2026-72897 CVE-2026-74934 CVE-2026-74935 CVE-2026-74936
CVE-2026-74937 CVE-2026-74938 CVE-2026-74939 CVE-2026-74940 CVE-2026-74941
CVE-2026-74942 CVE-2026-74943 CVE-2026-74944 CVE-2026-74945 CVE-2026-74946
CVE-2026-74947 CVE-2026-74948 CVE-2026-74949 CVE-2026-74950 CVE-2026-74952
CVE-2026-74953 CVE-2026-74954 CVE-2026-74955 CVE-2026-74956 CVE-2026-74957
CVE-2026-74958 CVE-2026-74959 CVE-2026-74960 CVE-2026-74961 CVE-2026-74962
CVE-2026-74963 CVE-2026-74964 CVE-2026-74965 CVE-2026-74966 CVE-2026-74967
CVE-2026-74968 CVE-2026-74969 CVE-2026-74970 CVE-2026-74971 CVE-2026-74972
CVE-2026-74973 CVE-2026-74974 CVE-2026-74976 CVE-2026-74977 CVE-2026-74978
CVE-2026-74979 CVE-2026-74981 CVE-2026-74982 CVE-2026-74983 CVE-2026-74984
CVE-2026-74985 CVE-2026-74986 CVE-2026-74987 CVE-2026-74988 CVE-2026-74990
CVE-2026-75803 CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-75874
CVE-2026-77117 CVE-2026-77696 CVE-2026-80489 CVE-2026-83557 CVE-2026-84118
CVE-2026-84119 CVE-2026-84120 CVE-2026-84121 CVE-2026-84122 CVE-2026-84123
CVE-2026-84124 CVE-2026-84125 CVE-2026-84129 CVE-2026-84130 CVE-2026-84131
CVE-2026-84132 CVE-2026-84133 CVE-2026-84134 CVE-2026-84136 CVE-2026-84137
CVE-2026-84139 CVE-2026-84140 CVE-2026-84141 CVE-2026-84143 CVE-2026-84144
CVE-2026-84145 CVE-2026-84782 CVE-2026-84784 CVE-2026-86145 CVE-2026-89156
CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-89407
CVE-2026-89425 CVE-2026-91776 CVE-2026-91777
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.2/x86_64/server-attestation was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2801-1
Released: Wed Jul 8 21:04:39 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent
Type: security
Severity: important
References: 1268603,1268897,1268898,1268899,1268902,CVE-2026-54512,CVE-2026-54513,CVE-2026-54514,CVE-2026-54515
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- jackson-core: document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
- Update to 2.18.8
* No changes since 2.17.3
Changes for jackson-bom:
- Update to 2.18.8
* Changes
+ #68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x
to help junit5 migration
+ 'base/pom.xml' now creates '${project.version.underscore}' for
'cleansed' version of '${project.version}'
Changes for jackson-core:
- Update to 2.18.8
* Changes of 2.18.8
+ #1611: Apply number-length validator on streaming integer path
of async parser
* Changes of 2.18.7
+ #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
+ #1600: Rework 3rd party licenses in jar
+ #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
* Changes of 2.18.6
+ #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
+ #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
+ #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
* Changes of 2.18.5
+ #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current token is non-numeric
instead of returning null
+ #1446: Invalid package reference to 'java.lang.foreign' from
'com.fasterxml.jackson.core:jackson-core' (from
'FastDoubleParser')
* Changes of 2.18.3
+ #1391: Fix issue where the parser can read back old number
state when parsing later numbers
+ #1397: Jackson changes additional values to infinite in case
of special JSON structures and existing infinite values
+ #1398: Fix issue that feature
COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
characterEscape is used
* Changes of 2.18.2
+ #1359: Non-surrogate characters being incorrectly combined
when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
enabled
* Changes of 2.18.1
+ #1353: Use fastdoubleparser 1.0.90
* Changes of 2.18.
+ #223: 'UTF8JsonGenerator' writes supplementary characters as a
surrogate pair: should use 4-byte encoding
+ #1230: Improve performance of 'float' and 'double' parsing
from 'TextBuffer'
+ #1251: 'InternCache' replace synchronized with 'ReentrantLock'
- the cache size limit is no longer strictly enforced for
performance reasons but we should never go far about the limit
+ #1252: 'ThreadLocalBufferManager' replace synchronized with
'ReentrantLock'
+ #1257: Increase InternCache default max size from 100 to 200
+ #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
+ #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
classes to prevent use by downstream consumers
+ #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
from 3.0)
+ #1274: 'NUL'-corrupted keys, values on JSON serialization
+ #1277: Add back Java 22 optimisation in FastDoubleParser
+ #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
/getDecimalValue()' to avoid String allocation
+ #1305: Make helper methods of 'WriterBasedJsonGenerator'
non-final to allow overriding
+ #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
limit maximum number of Tokens allowed per document#
+ #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
decoding proble
Changes for jackson-databind:
- Update to 2.18.8
* Changes of 2.18.8
+ #5950: Improve 'UUIDeserializer' error handling
+ #5951: Improve 'InetSocketAddress' deserialization
(bsc#1268899, CVE-2026-54514)
+ #5969: '@JsonView' by-passed for some 'setterless' creator
properties
+ #5971: '@JsonView' by-passed for unwrapped creator parameters
+ #5974: '@JsonIgnore' on Record property ignored with
'PropertyNamingStrategy'
+ #5981: 'BasicPolymorphicTypeValidator' setting
'allowIfSubTypeIsArray()' should validate element type
(bsc#1268898, CVE-2026-54513)
+ #5988: 'PolymorphicTypeValidator' needs to validate generic
type parameters too (bsc#1268897, CVE-2026-54512)
+ #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
fold case using JVM default locale (Turkish-I bug)
* Changes of 2.18.4
+ #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
Record property ignored for deserialization
+ #5049: Duplicate creator property 'b' (index 0 vs 1) on simple
java record
* Changes of 2.18.3
+ #4444: The 'KeyDeserializer' specified in the class with
'@JsonDeserialize(keyUsing = ...)' is overwritten by the
'KeyDeserializer' specified in the 'ObjectMapper'.
+ #4827: Subclassed Throwable deserialization fails since
v2.18.0 - no creator index for property 'cause'
+ #4844: Fix wrapped array handling wrt 'null' by
'StdDeserializer'
+ #4848: Avoid type pollution in 'StringCollectionDeserializer'
+ #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not
work with multiple constructors since 2.18
+ #4878: When serializing a Map via
Converter(StdDelegatingSerializer), a NullPointerException is
thrown due to missing key serializer
+ #4908: Deserialization behavior change with @JsonCreator and
@ConstructorProperties between 2.17 and 2.18
+ #4917: 'BigDecimal' deserialization issue when using
'@JsonCreator'
+ #4920: Creator properties are ignored on abstract types when
collecting bean properties, breaking AsExternalTypeDeserializer
+ #4922: Failing '@JsonMerge' with a custom Map
+ #4932: Conversion of 'MissingNode' throws
'JsonProcessingException'
* Changes of 2.18.2
+ #4733: Wrong serialization of Type Ids for certain types of
Enum values
+ #4742: Deserialization with Builder, External type id,
'@JsonCreator' failing
+ #4777: 'StdValueInstantiator.withArgsCreator' is now set for
creators with no arguments
+ #4783 Possibly wrong behavior of @JsonMerge
+ #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'
hides actual error
+ #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides
'@JsonProperty' values
+ #4790: Fix '@JsonAnySetter' issue with 'setter' method
(related to #4639)
+ #4807: Improve 'FactoryBasedEnumDeserializer' to work better
with XML module
+ #4810: Deserialization using '@JsonCreator' with renamed
property failing (since 2.18)
* Changes of 2.18.1
+ #4508: Deserialized JsonAnySetter field in Kotlin data class
is null
+ #4639: @JsonAnySetter on field ignoring unrecognized
properties if they are declared before the last recognized
properties in JSON
+ #4718: Should not fail on trying to serialize
'java.time.DateTimeException'
+ #4724: Deserialization behavior change with Records,
'@JsonCreator' and '@JsonValue' between 2.17 and 2.18
+ #4727: Eclipse having issues due'module-info' class 'lost' on
2.18.0 jars
+ #4741: When 'Include.NON_DEFAULT' setting is used on POJO,
empty values are not included in json if default is 'null'
+ #4749: Fixed a problem with
'StdDelegatingSerializer#serializeWithType' looking up the
serializer with the wrong argument
* Changes of 2.18.0
+ #562: Allow '@JsonAnySetter' to flow through Creators
+ #806: Problem with 'NamingStrategy', creator methods with
implicit names
+ #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and
field level '@JsonProperty'
+ #3120: Return 'ListIterator' from 'ArrayNode.elements()'
+ #3241: 'constructorDetector' seems to invalidate
'defaultSetterInfo' for nullability
+ #3439: Java Record '@JsonAnySetter' value is null after
deserialization
+ #4085: '@JsonView' does not work on class-level for records
+ #4119: Exception when deserialization uses a record with a
constructor property with 'access=READ_ONLY'
+ #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't
work for beans with Creator methods
+ #4407: 'null' type id handling does not work with
'writeTypePrefix()'
+ #4452: '@JsonProperty' not serializing field names properly on
'@JsonCreator' in Record
+ #4453: Allow JSON Integer to deserialize into a single-arg
constructor of parameter type 'double'
+ #4456: Rework locking in 'DeserializerCache'
+ #4458: Rework synchronized block from 'BeanDeserializerBase'
+ #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'
method is not called on the serializer
+ #4472: Rework synchronized block in 'TypeDeserializerBase'
+ #4483: Remove 'final' on method BeanSerializer.serialize()
+ #4515: Rewrite Bean Property Introspection logic in Jackson
2.x
+ #4545: Unexpected deserialization behavior with
'@JsonCreator', '@JsonProperty' and javac '-parameters'
+ #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper
.canSerialize()'
+ #4580: Add 'MapperFeature
.SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator
properties' declaration order for sorting
+ #4584: Provide extension point for detecting 'primary'
Constructor for Kotlin (and similar) data classes
+ #4602: Possible wrong use of _arrayDelegateDeserializer in
BeanDeserializerBase::deserializeFromObjectUsingNonDefault()
+ #4617: Record property serialization order not preserved
+ #4626: '@JsonIgnore' on Record property ignored for
deserialization, if there is getter override
+ #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'
ignored when serializing Records, if there is getter override
+ #4634: '@JsonAnySetter' not working when annotated on both
constructor parameter & field
+ #4678: Java records don't serialize with 'MapperFeature
.REQUIRE_SETTERS_FOR_GETTERS'
+ #4688: Should allow deserializing with no-arg
'@JsonCreator(mode = DELEGATING)'
+ #4694: Deserializing 'BigDecimal' with large number of
decimals result in incorrect value
+ #4699: Add extra 'writeNumber()' method in 'TokenBuffer'
+ #4709: Add 'JacksonCollectors' with 'toArrayNode()'
implementation
+ Fix #5962: Case-insensitive deserialization may use wrong
@JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)
- Fix 'Not fully interpolated version' error with Maven 4
Changes for jackson-dataformats-binary:
- Update to 2.18.8
* Changes of 2.18.8
+ #696: (ion) Incomplete number length validation in Ion decoder
(for 'BigDecimal' and/or 'BigInteger')
* Changes of 2.18.6
+ #645: (avro) Remove use of Avro 'Schema.Parser()
.setValidate()' to allow use of Avro core 1.12.1 (2.x)
+ #649: (cbor, smile) 'StreamReadConstraints.maxDocumentLength'
not checked when creating parser with fixed buffer
+ #651: (smile) Ensure Smile backend supports
'StreamReadConstraints.maxTokenCount'
+ #652: (cbor) Ensure CBOR backend supports
+ Minor fix to 'ProtobufGenerator._reportEnumError()' helper
method
* Changes of 2.18.5
+ #599: (cbor) Unable to deserialize stringref-enabled CBOR with
ignored properties
+ #623: (ion) Upgrade 'ion-java' dep to 1.11.11 (from 1.11.10)
* Changes of 2.18.4
+ #569: (ion) 'IonParser' fails to parse some 'long' values
saying they are out of range when they are not
+ #584: (protobuf) Missing 'JsonToken.END_OBJECT' for nested
Protobuf Objects
+ (ion) Upgrade 'ion-java' to 1.11.10 (from 1.11.9)
* Changes of 2.18.3
+ #541: (cbor, protobuf, smile) 'SmileParser.getValueAsString()'
FIELD_NAME bug
* Changes of 2.18.1
+ #518: Should not read past end for CBOR string values
* Changes of 2.18.0
+ #167: (avro) Incompatibility with Avro >=1.9.0 (upgrade to
Avro 1.11.3)
+ #484: (protobuf) Rework synchronization in 'ProtobufMapper'
+ #494: (avro) Avro Schema generation: allow mapping Java Enum
properties to Avro String values
+ #508: (avro) Ignore 'specificData' field on serialization
+ #509: IonValueMapper.builder() not implemented, does not
register modules
* (ion) Upgrade 'ion-java' to 1.11.9 (from 1.11.8)
value
Changes for jackson-modules-base:
- Upgrade to 2.18.8
* No changes since 2.18.0
* Changes of 2.18.0
+ #233: (jaxb) Tolerate JAX-RS 2.2 in
jackson-module-jaxb-annotations so that it can be deployed in
Liberty alongside features which use 2.2
+ #248: (android-record) jClass annotations and polymorphic
types are ignored when deserializing Android Record fields
+ #251: (android-record) Constructor is not recognized when a
record uses both arrays and generic types
Changes for jackson-parent:
- Update to 2.18.4
* Changes of 2.18.4
+ Update to latest 'oss-parent' (69)
* Changes of 2.18.3
+ Update to latest 'oss-parent' (68)
+ Switch to publishing via Sonatype Central Portal repo
* Changes of 2.18.2
+ Update to latest 'oss-parent' (66); future-proof for Sonatype
Central Portal
* Changes of 2.18.1
+ #15: Add override to downgrade 'moditect-maven-plugin' from
1.2.2 to 1.1.0 to work around Eclipse issues
* Changes of 2.18
+ Update to oss-parent 61 (plugin version updates)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3145-1
Released: Tue Jul 21 10:38:13 2026
Summary: Recommended update for log4j
Type: recommended
Severity: important
References:
This update for log4j fixes the following issues:
log4j was updated and includes fixes and improvements from versions 2.21.0 through 2.26.0:
- Bugs fixed:
- Fixed crashes when logging errors with stack traces modified by other threads
- Fixed FATAL-level log messages being silently discarded
- Fixed memory leaks in several components
- Fixed log file headers not being written correctly when files are recreated
- Fixed log file rotation failures
- Fixed configuration file loading from HTTP sources
- Fixed date and time formatting issues in logs
- Fixed problems when multiple threads modify logger settings simultaneously
- Fixed MongoDB appender connection issues
- New Features Added:
- Support for ZStandard compression for log files
- Support for LMAX Disruptor 4.x (high-performance logging)
- Better support for GraalVM environments
- Java 8 users now get sub-millisecond precision timestamps
- Features Removed:
- JMX GUI tool (moved to separate release)
- Flume Appender (moved to separate release)
- Kubernetes lookup feature (users should migrate to io.fabric8:kubernetes-log4j)
- JAnsi library support (Windows 10+ has built-in color support)
- Important Changes:
- JMX monitoring is now DISABLED by default (set log4j2.disableJmx=false to enable)
- Default log format has changed
- Configuration scripts now require explicit names
- Deprecations (features to be removed in the future):
- MongoDB4 module (use standard MongoDB module instead)
- EventLogger class
- Some builder methods (replaced with setter methods)
New Runtime Dependencies:
- jackson-dataformat-xml
- stax2-api
- woodstox-core
New and Updated Build Dependencies:
- aalto-xml (updated from version 1.3.3 to 1.4.0)
- jakarta-annotations (new)
- jakarta-messaging (new)
- jspecify (new)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3182-1
Released: Wed Jul 22 09:25:44 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service
(bsc#1262684).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3244-1
Released: Fri Jul 24 15:11:25 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1261400,1261982,1261983,1262305,1267644,1267647,CVE-2026-40226
This update for systemd fixes the following issues
Security issues fixed:
- CVE-2026-40226: nspawn: escape-to-host via malformed optional config file (bsc#1261400).
Other updates and bugfixes:
- Fix soft reboot not restarting user services with default.target (bsc#1262305).
- Import commit e46e1952d5 (bsc#1267647 bsc#1262305 bsc#1267644).
- Import commit 429043ca9a (bsc#1261982 bsc#1261983).
- Import commit 58e5d2e21e (bsc#1261982).
- Import commit 4bd91117cc (bsc#1261983).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3270-1
Released: Mon Jul 27 13:01:22 2026
Summary: Security update for alsa
Type: security
Severity: moderate
References: 1268853,CVE-2026-56109
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory
(bsc#1268853).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3273-1
Released: Mon Jul 27 13:32:13 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
Type: security
Severity: moderate
References: 1268902,1271440,1271442,CVE-2026-54515,CVE-2026-59888,CVE-2026-59889
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of
@JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to
@JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of
@JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-bom:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
* honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
Changes for jackson-dataformats-binary:
- Update to 2.18.9.
Changes for jackson-modules-base:
- Update to 2.18.9.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3381-1
Released: Tue Jul 28 17:35:03 2026
Summary: Recommended update for log4j
Type: recommended
Severity: important
References:
This update for log4j fixes the following issues:
Upgrade to 2.26.1:
* Changed
+ Improve logging for LinkageError scenarios involving the LMAX
Disruptor library
* Fixed
+ Fix the createOnDemand behavior of RollingFileAppender to
correctly defer file and directory creation until the first
log event, while preserving eager creation when disabled
+ Improve documentation for locale handling in the Pattern
Layout date pattern converter
+ Fix handling of non-finite numbers while encoding MapMessage
to JSON
+ Fix encoding of MSGID and SD-ID fields of
StructuredDataMessage to XML
+ Fix stack trace rendering for exceptions with identity
malfunction (e.g., colliding equals() and/or hashCode()
implementations)
+ Fix resource leaks in ConfigurationSource when loading
configuration via URL fails
+ Fix KafkaAppender reporting error to error handler even after
a successful retry
- Generate META-INF/services files using bnd-maven-plugin
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3406-1
Released: Wed Jul 29 13:09:09 2026
Summary: Security update for java-17-openjdk
Type: security
Severity: important
References: 1264396,1264994,1267355,1272223,1272224,1272225,1272227,1272228,1272235,1272236,1272237,CVE-2026-41254,CVE-2026-46917,CVE-2026-46968,CVE-2026-47010,CVE-2026-47021,CVE-2026-47027,CVE-2026-47059,CVE-2026-47063,CVE-2026-60147
This update for java-17-openjdk fixes the following issues:
Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU).
Security issues fixed:
- CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in `CubeSize` (bsc#1264994).
- CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1272223).
- CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or
modification access to critical data(bsc#1272224).
- CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert or delete access to some data (bsc#1272225).
- CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272227).
- CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272228).
- CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272235).
- CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,
deletion or modification access to critical data (bsc#1272236).
- CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert, delete and read access to some(bsc#1272237).
Other updates and bugfixes:
- Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
- Make post scripts less noisy (bsc#1267355).
- Use libalternatives instead of update-alternatives for distributions where libalternatives is available.
- Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU):
+ JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+ JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
+ JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails
+ JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel
+ JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F
+ JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/
/PrintDialogsTest.java instruction need to update
+ JDK-8183336: Better cleanup for jdk/test/java/lang/module/
/customfs/ModulesInCustomFileSystem.java
+ JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+ JDK-8240908: RetransformClass does not know about
MethodParameters attribute
+ JDK-8255463: java/nio/channels/spi/SelectorProvider/
/inheritedChannel/InheritedChannelTest.java failed with
ThreadTimeoutException
+ JDK-8272477: Additional cleanup of test/jdk/java/nio/file/spi/
/SetDefaultProvider.java
+ JDK-8274082: Wrong test name in jtreg run tag for java/awt/
/print/PrinterJob/SwingUIText.java
+ JDK-8277444: Data race between
JvmtiClassFileReconstituter::copy_bytecodes and class linking
+ JDK-8281243: Test java/lang/instrument/
/RetransformWithMethodParametersTest.java is failing
+ JDK-8282044: [JVMCI] Export _sha3_implCompress,
_md5_implCompress and aarch64::_has_negatives stubs to JVMCI
compiler.
+ JDK-8284993: Replace System.exit call in swing tests with
RuntimeException
+ JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads
the spinner value wrong and sometime partially
+ JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/
/nativeAndMH/Test.java fails with Out of space in CodeCache
+ JDK-8287062: com/sun/jndi/ldap/LdapPoolTimeoutTest.java failed
due to different timeout message
+ JDK-8290504: Close streams returned by ModuleReader::list
+ JDK-8293484: AArch64:
TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU
with SHA512 feature support
+ JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages
+ JDK-8298783: java/lang/ref/FinalizerHistogramTest.java failed
with 'RuntimeException: MyObject is not found in test output'
+ JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with 'No MouseReleased
event on label!'
+ JDK-8299304: Test 'java/awt/print/PrinterJob/
/PageDialogTest.java' fails on macOS 13 x64 because the Page
Dialog blocks the Toolkit
+ JDK-8304065: HttpServer.stop should terminate immediately if
no exchanges are in progress
+ JDK-8309142: Refactor test/langtools/tools/javac/versions/
/Versions.java
+ JDK-8316274: javax/swing/ButtonGroup/
/TestButtonGroupFocusTraversal.java fails in Ubuntu 23.10 with
Motif LAF
+ JDK-8317801: java/net/Socket/asyncClose/Race.java fails
intermittently (aix)
+ JDK-8320677: Printer tests use invalid '@run main/manual=yesno
+ JDK-8321182: SourceExample.SOURCE_14 comment should refer to
'switch expressions' instead of 'text blocks'
+ JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+ JDK-8323089: networkaddress.cache.ttl is not a system property
+ JDK-8323545: java/awt/GraphicsDevice/CheckDisplayModes.java
fails with 'exit code: 133'
+ JDK-8323672: Suppress unwanted autoconf added flags in CC and
CXX
+ JDK-8324345: Stack overflow during C2 compilation when
splitting memory phi
+ JDK-8324641: [IR Framework] Add Setup method to provide custom
arguments and set fields
+ JDK-8328300: Convert PrintDialogsTest.java from Applet to main
program
+ JDK-8332495: java/util/logging/LoggingDeadlock2.java fails
with AssertionError: Some tests failed
+ JDK-8334928: Test sun/security/ssl/SSLSocketImpl/
/ReuseAddr.java failed: java.net.BindException: Address
already in use
+ JDK-8337876: [IR Framework] Add support for IR tests with
@Stable
+ JDK-8338103: Stabilize and open source a Swing OGL
ButtonResizeTest
+ JDK-8338112: Test testlibrary_tests/ir_framework/tests/
/TestPrivilegedMode.java fails with release build
+ JDK-8338344: Test TestPrivilegedMode.java intermittent fails
java.lang.NoClassDefFoundError: jdk/test/lib/Platform
+ JDK-8338554: Fix inconsistencies in javadoc/doclet/
/testLinkOption/TestRedirectLinks.java
+ JDK-8338883: Show warning when CreateCoredumpOnCrash set, but
core dump will not happen
+ JDK-8339233: Test javax/swing/JButton/
/SwingButtonResizeTestWithOpenGL.java#id failed: Button
renderings are different after window resize
+ JDK-8339238: Update to use jtreg 7.5.1
+ JDK-8339879: Open some dialog awt tests
+ JDK-8339975: Open some dialog awt tests 2
+ JDK-8340140: Open some dialog awt tests 3
+ JDK-8340336: Open some checkbox awt tests
+ JDK-8340494: Open some dialog awt tests 4
+ JDK-8340851: Open some TextArea awt tests
+ JDK-8340987: Open some TextArea awt tests 1
+ JDK-8341055: Open some TextArea awt tests 2
+ JDK-8341292: Open some TextArea awt tests 3
+ JDK-8341376: Open some TextArea awt tests 4
+ JDK-8341427: JFR: Adjust object sampler span handling
+ JDK-8342401: [TESTBUG] javax/swing/JSpinner/8223788/
/JSpinnerButtonFocusTest.java test fails in ubuntu 22.04 on
SBR Hosts
+ JDK-8345618: javax/swing/text/Caret/8163124/
/CaretFloatingPointAPITest.java leaves Caret is not complete
+ JDK-8346154: [XWayland] Some tests fail intermittently in the
CI, but not locally
+ JDK-8347811: Container detection code for cgroups v2 should
use cgroup.controllers
+ JDK-8347836: Disabled PopupMenu shows shortcuts on Mac
+ JDK-8349192: jvmti/scenarios/contention/TC05/tc05t001 fails:
ERROR: tc05t001.cpp, 281: (waitedThreadCpuTime -
waitThreadCpuTime) < (EXPECTED_ACCURACY * 1000000)
+ JDK-8349533: Refactor validator tests shell files to java
+ JDK-8349988: Change cgroup version detection logic to not
depend on /proc/cgroups
+ JDK-8350749: Upgrade JLine to 3.29.0
+ JDK-8352685: Opensource JInternalFrame tests - series2
+ JDK-8352733: Improve RotFontBoundsTest test
+ JDK-8352877: Opensource Several Font related tests - Batch 1
+ JDK-8353488: Open some JComboBox bugs 3
+ JDK-8353552: Opensource Several Font related tests - Batch 3
+ JDK-8354163: Open source Swing tests Batch 1
+ JDK-8354469: Keytool exposes the password in plain text when
command is piped using | grep
+ JDK-8354695: Open source several swing tests batch7
+ JDK-8354878: File Leak in
CgroupSubsystemFactory::determine_type of
cgroupSubsystem_linux.cpp:300
+ JDK-8354900: javax/swing/AbstractButton/bug4133768.java
failing on macosx-aarch64
+ JDK-8355048: ProblemList TestGlyphVectorLayout.java on all
platforms
+ JDK-8355179: Reinstate javax/swing/JScrollBar/4865918/
/bug4865918.java headful and macos run
+ JDK-8355332: Fix failing semi-manual test EDT issue
+ JDK-8355443: [java.io] Use @requires tag instead of exiting
based on File.separatorChar value
+ JDK-8355445: [java.nio] Use @requires tag instead of exiting
based on 'os.name' property value
+ JDK-8356107: [java.lang] Use @requires tag instead of exiting
based on os.name or separatorChar property
+ JDK-8357062: Update Public Suffix List to 823beb1
+ JDK-8357082: Stabilize and add debug logs to CopyAreaOOB.java
+ JDK-8357141: Update to use jtreg 7.5.2
+ JDK-8357280: (bf) Remove @requires tags from java/nio/Buffer/
/LimitDirectMemory[NegativeTest].java
+ JDK-8357390: java/awt/Toolkit/ScreenInsetsTest/
/ScreenInsetsTest.java Test failing on Ubuntu 24.04 Vm Hosts
used by Oracle's internal CI system
+ JDK-8358058: sun/java2d/OpenGL/DrawImageBg.java Test fails
intermittently
+ JDK-8358751: C2: Recursive inlining check for compiled lambda
forms is broken
+ JDK-8359978: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java
failed again with java.net.SocketException: An established
connection was aborted by the software in your host machine
+ JDK-8360160: ubuntu-22-04 machine is failing client tests
+ JDK-8360882: Tests throw SkippedException when they should
fail
+ JDK-8361106: [TEST] com/sun/net/httpserver/Test9.java fails
with java.nio.file.FileSystemException
+ JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a
+ JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25
+ JDK-8364190: JFR: RemoteRecordingStream withers don't work
+ JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles
+ JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java
+ JDK-8365379: SU3.applyInsets may produce wrong results
+ JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26
+ JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26
+ JDK-8365526: Crash with null Symbol passed to
SystemDictionary::resolve_or_null
+ JDK-8365625: Can't change accelerator colors in Windows L&F
+ JDK-8366128: jdk/jdk/nio/zipfs/TestPosix.java::testJarFile
uses wrong file
+ JDK-8366261: Provide utility methods for
sun.security.util.Password
+ JDK-8366369: Add @requires linux for GTK L&F tests
+ JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing
+ JDK-8367583: sun/security/util/AlgorithmConstraints/
/InvalidCryptoDisabledAlgos.java fails after JDK-8244336
+ JDK-8367772: Refactor createUI in PassFailJFrame
+ JDK-8367784: java/awt/Focus/InitialFocusTest/
/InitialFocusTest1.java failed with Wrong focus owner
+ JDK-8368041: Enhance TLS certificate handling
+ JDK-8368335: Refactor the rest of Locale TestNG based tests to
JUnit
+ JDK-8368498: Use JUnit instead of TestNG for jdk_text tests
+ JDK-8368551: Core dump warning may be confusing
+ JDK-8368670: Deadlock in JFR on event register + class load
+ JDK-8368683: [process] Increase jtreg debug output
maxOutputSize for TreeTest
+ JDK-8368754: runtime/cds/appcds/SignedJar.java log regex is
too strict
+ JDK-8368885: NMT CommandLine tests can check for error better
+ JDK-8368892: Make JEditorPane/TestBrowserBGColor.java headless
+ JDK-8369251: Opensource few tests
+ JDK-8369319: java/net/httpclient/CancelRequestTest.java fails
intermittently
+ JDK-8369335: Two sun/java2d/OpenGL tests fail on Windows
after JDK-8358058
+ JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)
+ JDK-8369851: Remove darcy author tags from langtools tests
+ JDK-8369858: Remove darcy author tags from jdk tests
+ JDK-8369911: Test sun/java2d/marlin/ClipShapeTest.java
#CubicDoDash, #Cubic and #Poly fail intermittent
+ JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException
+ JDK-8370325: G1: Disallow GC for TLAB allocation
+ JDK-8370511: test/jdk/javax/swing/JSlider/bug4382876.java does
not release previously pressed keys
+ JDK-8370732: Use WhiteBox.getWhiteBox().fullGC() to provoking
gc for nsk/jvmti tests
+ JDK-8370942: test/jdk/java/security/Provider/NewInstance.java
and /test/jdk/java/security/cert/CertStore/NoLDAP.java may
skip without notifying
+ JDK-8371365: Update javax/swing/JFileChooser/bug4759934.java
to use Util.findComponent()
+ JDK-8371366: java/net/httpclient/whitebox/
/RawChannelTestDriver.java fails intermittently in jtreg
timeout
+ JDK-8371383: Test sun/security/tools/jarsigner/
/DefaultOptions.java failed due to
CertificateNotYetValidException
+ JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests
+ JDK-8372120: Add missing sound keyword to MIDI tests
+ JDK-8372351: Add 2 WISeKey roots
+ JDK-8372609: Bug4944439 does not enforce locale correctly
+ JDK-8372661: Add a null-safe static factory method to
'jdk.test.lib.net.SimpleSSLContext'
+ JDK-8372988: Test runtime/Nestmates/membership/
/TestNestHostErrorWithMultiThread.java failed: Unexpected
interrupt
+ JDK-8373101: JdkClient and JdkServer test classes ignore
namedGroups field
+ JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages
+ JDK-8373275: Improve DTLS handshaking
+ JDK-8373623: Refactor Serialization tests for Records to JUnit
+ JDK-8373650: Test 'javax/swing/JMenuItem/6458123/
/ManualBug6458123.java' fails because the check icons are not
aligned properly as expected
+ JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms
+ JDK-8373716: Refactor further java/util tests from TestNG to
JUnit
+ JDK-8373807: test/jdk/java/net/httpclient/websocket/
/DummyWebSocketServer.java getURI() uses 'localhost'
+ JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the “Nothing†menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test
+ JDK-8373869: Refactor java/net/httpclient/
/ThrowingPushPromises*.java tests to use JUnit5
+ JDK-8373928: 4 Dangling pointer defect groups in java.c
+ JDK-8373931: Test javax/sound/sampled/Clip/
/AutoCloseTimeCheck.java timed out
+ JDK-8374058: Enhance JPEG handling
+ JDK-8374178: Missing include in systemDictionary.cpp after
JDK-8365526
+ JDK-8374304: MultiResolutionSplashTest.java fails in CI:
'Image with wrong resolution is used for splash screen!'
+ JDK-8374433: java/util/Locale/PreserveTagCase.java does not
run any tests
+ JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F
+ JDK-8374548: Process httpserver cancelled keys more quickly
+ JDK-8374555: No need for visible input warning in
s.s.u.Password when not reading from System.in
+ JDK-8374711: Hotspot runtime/CommandLine/OptionsValidation/
/TestOptionsWithRanges fails without printing the option name
+ JDK-8374888: Implement internal test cache to help
UserIterCount test performance
+ JDK-8374998: Failing os::write - remove bad file
+ JDK-8375065: Update LCMS to 2.18
+ JDK-8375080: The tools/jpackage/windows/Win8365790Test.java
may fail with ClassNotFoundException: jtreg.SkippedException
+ JDK-8375231: Refactor util/ServiceLoader tests to use JUnit
+ JDK-8375232: Refactor util/StringJoiner tests to use JUnit
+ JDK-8375233: Refactor util/Vector tests to use JUnit
+ JDK-8375999: com/sun/jndi/ldap/LdapPoolTimeoutTest.java fails
sporadically on Windows
+ JDK-8376031: HttpsURLConnection.getServerCertificates() throws
'java.lang.IllegalStateException: connection not yet open' for
the HEAD method
+ JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed
+ JDK-8376233: Clean up code in Desktop native peer
+ JDK-8377158: Enhance XBM image support
+ JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable
+ JDK-8377498: Improve HttpServer handling
+ JDK-8377602: Create automated test for PageRange
+ JDK-8377678: G1: Heap Dumping crashes with -UseClassUnloading
+ JDK-8377727: Ghost caret and focus appear in non‑editable text
fields
+ JDK-8377833: Enhance Jar file processing
+ JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java
+ JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace
+ JDK-8378113: Add sun/java2d/OpenGL/ScaleParamsOOB.java to the
ProblemList.txt file
+ JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable
+ JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob
+ JDK-8378687: Improve delegation of HttpURLConnection
+ JDK-8378777: Bump update version for OpenJDK: jdk-17.0.20
+ JDK-8378802: [21u] backport changes to TKit.java by
JDK-8352419
+ JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument
+ JDK-8380565: PPC64: deoptimization stub should save vector
registers
+ JDK-8380672: Improve certification checking
+ JDK-8380947: Add pull request template
+ JDK-8381039: Enhance AWT ImagingLib
+ JDK-8381049: Enhance Jar handling
+ JDK-8381205: GHA: Upgrade Node.js 20 to 24
+ JDK-8381519: Enhance Der Value Handling
+ JDK-8381796: Enhance Certificate parsing
+ JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String
+ JDK-8383175: (tz) Update Timezone Data to 2026b
+ JDK-8383354: Update LCMS to 2.19.1
+ JDK-8383473: Follow on from tzdata2026b time change to include
temporary hack BC time change
+ JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
'weak' on 'phantom' path
+ JDK-8383630: Fix iteration in tests doing class redefinition
+ JDK-8383659: [17u] JVM crashes during stub routines generation
on Windows and rare combination of CPU features
+ JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily
+ JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025
+ JDK-8384495: Update Libpng to 1.6.58
+ JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates
+ JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate
+ JDK-8384902: Update GIFlib to 6.1.3
+ JDK-8385390: Update FreeType to 2.14.3
+ JDK-8385490: Update HarfBuzz to 14.2.0
+ JDK-8386343: [17u] Fix NTLMHeadTest after backport of 8384486
+ JDK-8386551: Windows build broken because of MSys2/Make update
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3493-1
Released: Tue Aug 4 14:11:00 2026
Summary: Security update for libpng16
Type: security
Severity: important
References:
This update for libpng16 fixes the following issues:
Changes for libpng16:
- version update to 1.6.58 (jsc#PED-16190).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3618-1
Released: Fri Aug 14 07:18:50 2026
Summary: Recommended update for apache-logging-parent, log4j
Type: recommended
Severity: moderate
References:
This update for apache-logging-parent, log4j fixes the following issues:
apache-logging-parent:
- Upgrade to logging-parent 12.1.1
* Main changes
+ Update to the latest upstream release (includes major updates
from versions 10, 11, and 12).
+ Better Security Tracking: Added tools (CycloneDX) to
automatically list all software ingredients (SBOM) used in the
build.
+ Updated Java Module Building: Swapped the old
maven-bundle-plugin for bnd-maven-plugin to better handle OSGi
and modern Java modules.
+ Stricter Code Quality: Added spotless-maven-plugin to enforce
a standard code style, and grouped bug-catching tools (Error
Prone, SpotBugs) into one place.
+ New Changelog System: Replaced the old Maven changes plugin
with a custom log4j-changelog-maven-plugin for managing
release notes.
+ Standardized Automation: Centralized GitHub Actions workflows
to make testing, building, and deploying more consistent
across projects.
+ Reliable Builds: Updated core Maven plugins and enforced
strict timestamp settings so that the same source code always
produces the exact same final files (reproducible builds).
log4j:
- Build with apache-logging-parent 12.1.1
+ Full osgi metadata generation
+ Bring back the annotation processing and generating the
Log4j2Plugins.dat descriptors
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3791-1
Released: Tue Aug 25 14:31:01 2026
Summary: Security update for snpguest
Type: security
Severity: important
References: 1270527,1270541,1270642,1270720,1270799,1270873,1270947,CVE-2026-41677,CVE-2026-41678,CVE-2026-41681,CVE-2026-41898,CVE-2026-42327,CVE-2026-44662,CVE-2026-45784
This update for snpguest fixes the following issues
- Update openssl to v0.10.81
- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-
openssl crate (bsc#1270541).
- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270642).
- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl
crate (bsc#1270720).
- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent
memory in rust-openssl crate (bsc#1270799).
- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate
(bsc#1270527).
- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate
(bsc#1270873).
- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in
rust-openssl crate (bsc#1270947).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3835-1
Released: Thu Aug 27 13:53:51 2026
Summary: Security update for openssl, openssl-3
Type: security
Severity: important
References: 1216950,1236136,1236599,1243014,1243459,1243564,1247463,1250233,1250234,1256829,1256831,1256832,1256833,1257274,1259652,1261678,1266344,1266347,CVE-2024-12797,CVE-2024-13176,CVE-2024-9143,CVE-2025-11187,CVE-2025-15468,CVE-2025-15469,CVE-2025-27587,CVE-2025-4575,CVE-2025-66199,CVE-2025-9231,CVE-2025-9232,CVE-2026-2673,CVE-2026-28390,CVE-2026-34182,CVE-2026-42764
This update for openssl, openssl-3 fixes the following issues:
OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)
* Enables Post-Quantum Cryptography (PQC) TLS support
Security issues fixed:
* CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
* CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
* CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
* CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652)
* CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833)
* CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB (bsc#1256832)
* CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829)
* CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831)
* CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
* CVE-2025-9232: Fix out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
* CVE-2025-4575: Fix the x509 application adding trusted use instead of rejected use (bsc#1243564)
* CVE-2025-27587: Minerva side channel vulnerability in P-384 (bsc#1243459)
* CVE-2024-12797: Fixed RFC7250 handshakes with unauthenticated servers don't abort as
expected. (bsc#1236599)
* CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation.
* CVE-2024-9143: Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
* CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)
POWER performance enhancements:
* Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)
- Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)
- Fix check %{suse_version} > 1600 (jsc#PED-15816)
- Fix NULL pointer dereference when processing an OCSP response
- Remove showciphers.c in favor of openssl ciphers
- Use %ldconfig_scriptlets
- Enable livepatching support for ppc64le [bsc#1257274]
- Move ssl configuration files to the libopenssl package [bsc#1247463]
- Don't install unneeded NOTES
- Disable LTO for userspace livepatching [jsc#PED-13245]
- Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]
- FIPS: Fix the speed command in FIPS mode for KMAC
- FIPS: Restore the check to deny SHA1 signatures in FIPS mode and
the functionality to allow/deny via crypto-policies. [jsc#PED-12224]
Update to 3.5.0:
* Changes:
- Default encryption cipher for the req, cms, and smime applications
changed from des-ede3-cbc to aes-256-cbc.
- The default TLS supported groups list has been changed to include
and prefer hybrid PQC KEM groups. Some practically unused groups
were removed from the default list.
- The default TLS keyshares have been changed to offer X25519MLKEM768
and and X25519.
- All BIO_meth_get_*() functions were deprecated.
* New features:
- Support for server side QUIC (RFC 9000)
- Support for 3rd party QUIC stacks including 0-RTT support
- Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
- A new configuration option no-tls-deprecated-ec to disable support
for TLS groups deprecated in RFC8422
- A new configuration option enable-fips-jitter to make the FIPS
provider to use the JITTER seed source
- Support for central key generation in CMP
- Support added for opaque symmetric key objects (EVP_SKEY)
- Support for multiple TLS keyshares and improved TLS key establishment
group configurability
- API support for pipelining in provided cipher algorithms
Changes between 3.3.0 and 3.4.0:
* Changes:
- Deprecation of TS_VERIFY_CTX_set_* functions and addition of
replacement TS_VERIFY_CTX_set0_* functions with improved semantics
- The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has fips=no property.
- SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the xoflen param is set before.
- Setting config_diagnostics=1 in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an
error in the ssl module configuration.
- An empty renegotiate extension will be used in TLS client hellos
instead of the empty renegotiation SCSV, for all connections with a
minimum TLS version > 1.0.
- Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and
SSL_CTX_flush_sessions() functions in favor of their respective _ex
functions which are Y2038-safe on platforms with Y2038-safe time_t
* New features:
- Support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions
- FIPS indicators support in the FIPS provider and various updates of
the FIPS provider required for future FIPS 140-3 validations
- Implementation of RFC 9579 (PBMAC1) in PKCS#12
- An optional additional random seed source RNG JITTER using a statically
linked jitterentropy library
- New options -not_before and -not_after for explicit setting start and
end dates of certificates created with the req and x509 apps
- Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
- Support for retrieving certificate request templates and CRLs in CMP
- Support for additional X.509v3 extensions related to Attribute Certificates
- Initial Attribute Certificate (RFC 5755) support
- Possibility to customize ECC groups initialization to use precomputed
values to save CPU time and use of this feature by the P-256 implementation
Changes between 3.2.0 and 3.3.0:
* Changes:
- Optimized AES-CTR for ARM Neoverse V1 and V2
- Various optimizations for cryptographic routines using RISC-V vector
crypto extensions
- Added assembly implementation for md5 on loongarch64
- Accept longer context for TLS 1.2 exporters
- The activate and soft_load configuration settings for providers in
openssl.cnf have been updated to require a value of [1|yes|true|on]
(in lower or UPPER case) to enable the setting. Conversely a value of
[0|no|false|off] will disable the setting.
- In openssl speed, changed the default hash function used with hmac from
md5 to sha256.
- The -verify option to the openssl crl and openssl req will make the
program exit with 1 on failure.
- The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(),
and related functions have been augmented to check for a minimum length
of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
- OPENSSL_sk_push() and sk__push() functions now return 0 instead of -1
if called with a NULL stack argument.
- New limit on HTTP response headers is introduced to HTTP client.
The default limit is set to 256 header lines.
* Bug fixes and mitigations:
- The BIO_get_new_index() function can only be called 127 times before
it reaches its upper bound of BIO_TYPE_MASK and will now return -1
once its exhausted.
* new features:
- Support for qlog for tracing QUIC connections has been added
- Added APIs to allow configuring the negotiated idle timeout for QUIC
connections, and to allow determining the number of additional streams
that can currently be created for a QUIC connection.
- Added APIs to allow disabling implicit QUIC event processing for QUIC
SSL objects
- Added APIs to allow querying the size and utilisation of a QUIC
stream's write buffer
- New API SSL_write_ex2, which can be used to send an end-of-stream (FIN)
condition in an optimised way when using QUIC.
- Limited support for polling of QUIC connection and stream objects in a
non-blocking manner.
- Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
- The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
output length.
- The EVP_PKEY_fromdata function has been augmented to allow for the
derivation of CRT (Chinese Remainder Theorem) parameters when requested
- Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
is enabled.
- Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
config
options and the respective calls to SSL[_CTX]_set1_sigalgs() and
SSL[_CTX]_set1_client_sigalgs() that start with ? character are ignored
and the configuration will still be used.
- Added -set_issuer and -set_subject options to openssl x509 to override
the Issuer and Subject when creating a certificate. The -subj option
now is an alias for -set_subject.
- Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
- New option SSL_OP_PREFER_NO_DHE_KEX, which allows configuring a TLS1.3
server to prefer session resumption using PSK-only key exchange over
PSK with DHE, if both are available.
- New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded.
- Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
- Support for using certificate profiles and extened delayed delivery in CMP
- FIPS: Mark SHA-1 as non-approved in the SLI. [jsc#PED-12224]
- Introduce --without lto. When %{optflags} contains -flto=*, tests cases are
also built using -flto=* which significantly increases build times, this
option disables lto which improve iteration times when developing.
Update to 3.2.4:
- Remove the engines' directories and symlinks that were added to
allow parallel installations with openssl-1_1.
- Add ktls capability [bsc#1216950]
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4002-1
Released: Mon Sep 7 09:27:14 2026
Summary: Security update for java-17-openjdk
Type: security
Severity: moderate
References: 1275035,1275764,1275777,1275778,CVE-2026-60589,CVE-2026-61308,CVE-2026-70907
This update for java-17-openjdk fixes the following issues:
Upgrade to upstream tag jdk-17.0.20.1+1 (August 2026 CSPU).
- CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access
to a subset of accessible data (bsc#1275777).
- CVE-2026-61308: unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data
(bsc#1275778).
- CVE-2026-70907: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1275764).
Changes for java-17-openjdk:
- Upgrade to upstream tag jdk-17.0.20.1+1 (August 2026 CSPU):
+ JDK-8389947: [17u] Remove designator `DEFAULT_PROMOTED_VERSION_PRE=ea` for release 17.0.20.1.
+ JDK-8333743: Change `.jcheck/conf` branches property to match valid branches
+ JDK-8388790: Bump update version for OpenJDK: jdk-17.0.20.1
- Backport upcoming upgrade of timezone data (bsc#1275035)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4039-1
Released: Mon Sep 7 10:29:11 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4055-1
Released: Mon Sep 7 17:48:12 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4110-1
Released: Wed Sep 9 17:00:16 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1212476,1227370,1236165,1239009,1242233,1243830,1252696,1253025,1258311,1259825,1262315,1275660
This update for crypto-policies fixes the following issues:
- Update crypto-policies for Post-Quantum Cryptography (PQC) TLS
support in SLE-15-SP7 (jsc#PED-16072):
* Add support for mlkem768x25519-sha256 in openssh 9.6p1 (bsc#1275660)
* Add support for python36 (jsc#PED-16072)
* Add support for sntrup761x25519-sha512 at openssh.com and remove
it for sntrup761x25519-sha512 in openssh 9.6p1 in SLE-15-SP7
as it only lists the former (bsc#1258311, bsc#1259825)
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
- Adapt the manpages to SUSE/openSUSE:
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: [bsc#1253025, bsc#1252696]
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
- Allow openssl to load when using the DEFAULT policy, and also
other policies, in FIPS mode. [bsc#1243830, bsc#1242233]
- Relax the nss version requirement since the mlkem768secp256r1
enablement has been reverted.
- Allow sshd in FIPS mode when using the DEFAULT policy [bsc#1227370]
- Enable SHA1 sigver in the DEFAULT policy.
- Remove also sequoia config and generator files
- Remove not needed fips bind mount service
- Update to version 20250124.4d262e7: [bsc#1239009, bsc#1236165]
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-setup-helper: add a libexec helper for anaconda
* fips-crypto-policy-overlay: automount FIPS policy
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* CONTRIBUTING.md: add a small section on updating policies
* CONTRIBUTING.md: remove trailing punctuation from headers
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
* nss: unconditionally load p11-kit-proxy.so
* gnutls: make DTLS0.9 controllable again
* gnutls: retire GNUTLS_NO_TLS_SESSION_HASH
* openssh: remove OPENSSH_MIN_RSA_SIZE / OPENSSH_MIN_RSA_SIZE_FORCE
* gnutls: remove extraneous newline
* sequoia: move away from subprocess.getstatusoutput
* python/cryptopolicies/cryptopolicies.py: add trailing commas
* python, tests: rename MalformedLine to MalformedLineError
* Makefile: introduce SKIP_LINTING flag for packagers to use
* Makefile: run ruff
* tests: use pathlib
* tests: run(check=True) + CalledProcessError where convenient
* tests: use subprocess.run
* tests/krb5.py: check all generated policies
* tests: print to stderr on error paths
* tests/nss.py: also use encoding='utf-8'
* tests/nss.py: also use removesuffix
* tests/nss.py: skip creating tempfiles
* tests/java.pl -> tests/java.py
* tests/gnutls.pl -> tests/gnutls.py
* tests/openssl.pl -> tests/openssl.py
* tests/verify-output.pl: remove
* libreswan: do not use up pfs= / ikev2= keywords for default behaviour
- Update to version 20241010.5930b9a:
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* nss: be stricter with new purposes
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* TEST-PQ: disable pure Kyber768
* nss: wire XYBER768D00 to X25519-KYBER768
* TEST-PQ: update
* TEST-PQ: also enable sntrup761x25519-sha512 at openssh.com
* TEST-PQ, alg_lists, openssl: enable more experimental `sign` values
* TEST-PQ, python: add more groups, mark experimental
* openssl: mark liboqsprovider groups optional with ?
- Update to version 20240201.9f501f3:
* .gitlab-ci.yml: install sequoia-policy-config
* java: disable ChaCha20-Poly1305 where applicable
* fips-mode-setup: make sure ostree is detected in chroot
* fips-finish-install: make sure ostree is detected in chroot
* TEST-PQ: enable X25519-KYBER768 / P384-KYBER768 for openssl
* TEST-PQ: add a no-op subpolicy
* update-crypto-policies: Keep mid-sentence upper case
* fips-mode-setup: Write error messages to stderr
* fips-mode-setup: Fix some shellcheck warnings
* fips-mode-setup: Fix test for empty /boot
* fips-mode-setup: Avoid 'boot=UUID=' if /boot == /
* Update man pages
- Update to version 20231108.adb5572b:
* Print matches in syntax deprecation warnings
* Restore support for scoped ssh_etm directives
* fips-mode-setup: Fix usage with --no-bootcfg
* turn ssh_etm into an etm at SSH tri-state
* fips-mode-setup: increase chroot-friendliness
* bind: fix a typo that led to duplication of ECDSAPxxxSHAxxx
* pylintrc: use-implicit-booleaness-not-comparison-to-*
- avoid the cycle rpm/cmake/crypto-policies/python-rpm-macros:
we only need python3-base here, we don't need the python
macros as no module is being built
- Remove dependency on /usr/bin/python3, making scripts to depends on
the real python3 binary, not the link. bsc#1212476
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4124-1
Released: Thu Sep 10 18:11:41 2026
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1277247
This update for glibc fixes the following issues:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural
optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4156-1
Released: Mon Sep 14 11:06:43 2026
Summary: Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen
Type: security
Severity: important
References: 1226112,1262698,1262701,1266262,1266263,1271649,1272772,1272773,1272774,1273243,1274867,1278001,1279863,CVE-2026-16349,CVE-2026-16350,CVE-2026-16351,CVE-2026-16352,CVE-2026-16353,CVE-2026-16354,CVE-2026-16355,CVE-2026-16356,CVE-2026-16357,CVE-2026-16358,CVE-2026-16359,CVE-2026-16360,CVE-2026-16362,CVE-2026-16363,CVE-2026-16364,CVE-2026-16365,CVE-2026-16366,CVE-2026-16367,CVE-2026-16368,CVE-2026-16369,CVE-2026-16370,CVE-2026-16371,CVE-2026-16372,CVE-2026-16373,CVE-2026-16374,CVE-2026-16375,CVE-2026-16376,CVE-2026-16377,CVE-2026-16378,CVE-2026-16379,CVE-2026-16380,CVE-2026-16381,CVE-2026-16382,CVE-2026-16383,CVE-2026-16384,CVE-2026-16385,CVE-2026-16386,CVE-2026-16387,CVE-2026-16388,CVE-2026-16389,CVE-2026-16390,CVE-2026-16391,CVE-2026-16392,CVE-2026-16393,CVE-2026-16394,CVE-2026-16395,CVE-2026-16396,CVE-2026-16397,CVE-2026-16398,CVE-2026-16399,CVE-2026-16400,CVE-2026-16401,CVE-2026-16402,CVE-2026-16403,CVE-2026-16404,CVE-2026-16405,CVE-2026-16406,CVE-2026-16407,CVE-2026-16
408,CVE-2026-16409,CVE-2026-16410,CVE-2026-16411,CVE-2026-16412,CVE-2026-74934,CVE-2026-74935,CVE-2026-74936,CVE-2026-74937,CVE-2026-74938,CVE-2026-74939,CVE-2026-74940,CVE-2026-74941,CVE-2026-74942,CVE-2026-74943,CVE-2026-74944,CVE-2026-74945,CVE-2026-74946,CVE-2026-74947,CVE-2026-74948,CVE-2026-74949,CVE-2026-74950,CVE-2026-74952,CVE-2026-74953,CVE-2026-74954,CVE-2026-74955,CVE-2026-74956,CVE-2026-74957,CVE-2026-74958,CVE-2026-74959,CVE-2026-74960,CVE-2026-74961,CVE-2026-74962,CVE-2026-74963,CVE-2026-74964,CVE-2026-74965,CVE-2026-74966,CVE-2026-74967,CVE-2026-74968,CVE-2026-74969,CVE-2026-74970,CVE-2026-74971,CVE-2026-74972,CVE-2026-74973,CVE-2026-74974,CVE-2026-74976,CVE-2026-74977,CVE-2026-74978,CVE-2026-74979,CVE-2026-74981,CVE-2026-74982,CVE-2026-74983,CVE-2026-74984,CVE-2026-74985,CVE-2026-74986,CVE-2026-74987,CVE-2026-74988,CVE-2026-74990,CVE-2026-75874,CVE-2026-84118,CVE-2026-84119,CVE-2026-84120,CVE-2026-84121,CVE-2026-84122,CVE-2026-84123,CVE-2026-84124,CVE-2026-84125,CVE
-2026-84129,CVE-2026-84130,CVE-2026-84131,CVE-2026-84132,CVE-2026-84133,CVE-2026-84134,CVE-2026-84136,CVE-2026-84137,CVE-2026-84139,CVE-2026-84140,CVE-2026-84141,CVE-2026-84143,CVE-2026-84144,CVE-2026-84145
This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:
Changes in MozillaFirefox:
Firefox Extended Support Release 153.2.0 ESR
* Fixed: Various security fixes.
MFSA 2026-85 (bsc#1278001):
* CVE-2026-75874: Sandbox escape in the Remote Settings Client component
* CVE-2026-84118: Use-after-free in the JavaScript: GC component
* CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation
component
* CVE-2026-84120: Use-after-free in the Audio/Video component
* CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security
component
* CVE-2026-84122: Use-after-free in the Audio/Video component
* CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics:
WebGPU component
* CVE-2026-84124: Use-after-free in the DOM: Core & HTML component
* CVE-2026-84125: Use-after-free in the DOM: Core & HTML component
* CVE-2026-74952: Privilege escalation in the Application Update component
* CVE-2026-84129: Site isolation issue in the DOM: Navigation component
* CVE-2026-84130: Information disclosure in the Graphics: WebGPU component
* CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics
component
* CVE-2026-84132: Information disclosure in the Networking: HTTP component
* CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component
* CVE-2026-84134: Other issue in the Profile Backup component
* CVE-2026-84136: Other issue in the DOM: Navigation component
* CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component
* CVE-2026-84139: Clickjacking issue in the DOM: Events component
* CVE-2026-84140: Site isolation issue in the DOM: Navigation component
* CVE-2026-84141: Integer overflow in the Graphics: ImageLib component
* CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2
and Firefox ESR 140.15
* CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR
153.2
* CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR
153.2, Firefox ESR 140.15 and Firefox ESR 115.40
* Fixed: Various security fixes.
MFSA 2026-77 (bsc#1274867):
* CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935: Privilege escalation in the DOM: Networking component
* CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74937: Use-after-free in the JavaScript: GC component
* CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
* CVE-2026-74939: Privilege escalation in the DOM: Navigation component
* CVE-2026-74940: Use-after-free in the Graphics: Text component
* CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942: Privilege escalation in the Remote Settings Client component
* CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
* CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
* CVE-2026-74945: Information disclosure in the Graphics: Text component
* CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component
* CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics
component
* CVE-2026-74948: Information disclosure in the Graphics component
* CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
* CVE-2026-74950: Privilege escalation in the Downloads API component
* CVE-2026-74953: Privilege escalation in the Networking: Cookies component
* CVE-2026-74954: Information disclosure due to side-channel in the Storage:
Cache API component
* CVE-2026-74955: Privilege escalation in the Request Handling component
* CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers
component
* CVE-2026-74957: Mitigation bypass in the Safe Browsing component
* CVE-2026-74958: Information disclosure in the WebRTC component
* CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
* CVE-2026-74960: Site isolation issue in the WebExtensions component
* CVE-2026-74961: Side-channel in the Web Audio component
* CVE-2026-74962: Site isolation issue in the Networking: Cookies component
* CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies
component
* CVE-2026-74964: Integer overflow in the Graphics component
* CVE-2026-74965: Privilege escalation in the Shell Integration component
* CVE-2026-74966: Information disclosure in the Form Autofill component
* CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback
component
* CVE-2026-74968: Site isolation issue in the Graphics: WebRender component
* CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
* CVE-2026-74970: Site isolation issue in the Graphics component
* CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling
component
* CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions
component
* CVE-2026-74973: Race condition, use-after-free in the Graphics component
* CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component
* CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-74977: Integer overflow in the Graphics component
* CVE-2026-74978: Clickjacking issue in the Widget component
* CVE-2026-74979: Mitigation bypass in the Add-ons Manager component
* CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component
* CVE-2026-74982: Denial-of-service in the Widget component
* CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component
* CVE-2026-74984: Race condition in the JavaScript Engine component
* CVE-2026-74985: Privilege escalation in the Enterprise Policies component
* CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation
component
* CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox
ESR 153.1 and Firefox 154
* CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox
154
* CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox
ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Firefox Extended Support Release 153.0esr ESR
* New: ## General
- Firefox now includes a new profile management system that
helps you separate your online life into distinct profiles
for work, school, vacation planning, or whatever you choose.
Profiles can be customized with names, avatars, and color
themes while keeping tabs, bookmarks, passwords, and browsing
history separate. Built-in profile backup and restore also
makes it easier to migrate to a new device or recover your
browsing data.
- Split View lets you view two webpages side-by-side in a
single browser window, with additional options to quickly
open links in Split View, rearrange pages, and search open
tabs.
- The Firefox address bar has gained several new
capabilities, including built-in unit and time zone
conversion, quick actions such as muting all browser audio,
and direct search results as you type.
- Firefox now supports copying links directly to highlighted
text on a webpage for easier sharing.
- Firefox Settings has been redesigned with improved
organization and navigation, making it easier to find and
customize browser preferences.
* New: ## AI
Firefox introduced several new AI-powered features, including
on-device tab organization, AI-assisted link previews,
integrated AI search, and centralized controls for managing
AI features. Whenever possible, these features perform
processing locally to help protect user privacy.
* New: ## Sidebar and Tabs
- Firefox continues to improve tab management with
enhancements to vertical tabs, tab groups, and the sidebar.
- Tab groups have gained numerous usability improvements,
including better support for collapsed groups, previews of
grouped tabs, and additional organization options.
- Passwords can now be accessed directly from the Firefox
sidebar without opening a separate tab.
- Firefox now supports copying links from one or multiple
background tabs directly from the tab context menu, and
multiple tabs can be copied or shared in a single action.
- A Send Tab toolbar button is now available through
Customize Toolbar.
* New: ## Security & Privacy
- Firefox has significantly expanded Fingerprinting
Protection, making it harder for websites to uniquely
identify users in both Standard and Strict Enhanced Tracking
Protection modes.
- Enhanced Tracking Protection includes stronger protections
against bounce tracking and additional safeguards that
restrict websites from accessing local network resources
without user permission.
- Firefox now uses Safe Browsing V5 for phishing and malware
protection.
- Firefox Password Manager now uses stronger AES-256
encryption to protect stored logins on disk.
- Private Browsing has been enhanced with new controls,
including the ability to instantly end a private browsing
session and temporarily relax tracker blocking for individual
sites when needed for compatibility.
* New: ## Translations
- Firefox has expanded on-device translation support with
many additional languages and continued improvements to
translation quality.
- A dedicated translations page now provides an easy way to
perform real-time translations directly within Firefox.
* New: ## Accessibility
- Firefox continues to improve accessibility with enhanced
support for assistive technologies, including Windows UI
Automation, improved keyboard navigation, more accessible
date and time controls, and better support for mathematical
content in PDFs.
* New: ## Windows
- Firefox now supports installing websites as standalone web
apps pinned to the Windows taskbar.
- Firefox web apps are also available for Microsoft Store
installations.
- Firefox now better integrates with Windows location
permissions when websites request geolocation access.
* New: ## macOS
- Firefox now uses a dedicated GPU process by default,
improving stability by allowing graphics failures to recover
without restarting the browser.
- WebGPU is now enabled by default on Apple Silicon Macs.
* New: ## Linux
- Firefox now supports native fractional scaling on Wayland,
improving rendering on high-DPI displays.
- Firefox no longer requires a restart after package manager
updates and uses less memory on Linux.
- Firefox now supports the XDG Base Directory Specification
and ships with RPM packages for Red Hat, Fedora, openSUSE,
and other RPM-based distributions.
* HTML5: - Firefox now supports the View Transitions API for
creating smooth animated transitions between application
views.
- WebGPU support has expanded across supported platforms,
including Windows and Apple Silicon Macs.
- Added support for several modern web platform APIs,
improving compatibility with modern web applications. Notable
additions include the Navigation API, URLPattern, Trusted
Types, Sanitizer API, and Prioritized Task Scheduling.
* Enterprise: - Enterprise administrators can now centrally
manage Firefox's Generative AI features through enterprise
policy.
- Fixed a performance regression affecting native messaging,
improving responsiveness for enterprise extensions that
communicate with external applications.
- Enterprise policy documentation has moved to
https://firefox-admin-docs.mozilla.org/.
* Fixed: Various security fixes.
MFSA 2026-68 (bsc#1271649):
* CVE-2026-16349:
Same-origin policy bypass in the DOM: Navigation component
* CVE-2026-16350:
Incorrect boundary conditions in the Audio/Video: cubeb
component
* CVE-2026-16362:
Use-after-free in the WebRTC: Audio/Video component
* CVE-2026-16351:
Sandbox escape due to use-after-free in the DOM: Navigation
component
* CVE-2026-16352:
Sandbox escape due to use-after-free in the Disability Access
APIs component
* CVE-2026-16363:
JIT miscompilation in the JavaScript: WebAssembly component
* CVE-2026-16364:
Incorrect boundary conditions in the Audio/Video: Playback
component
* CVE-2026-16365:
Privilege escalation in the DOM: Workers component
* CVE-2026-16366:
Privilege escalation in the DOM: Navigation component
* CVE-2026-16353:
Invalid pointer in the DOM: Bindings (WebIDL) component
* CVE-2026-16354:
Information disclosure in the Graphics: ImageLib component
* CVE-2026-16367:
Sandbox escape due to invalid pointer in the Disability
Access APIs component
* CVE-2026-16368:
Incorrect boundary conditions in the JavaScript: WebAssembly
component
* CVE-2026-16369:
Integer overflow in the JavaScript: WebAssembly component
* CVE-2026-16355:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16356:
Sandbox escape due to use-after-free in the Disability Access
APIs component
* CVE-2026-16357:
Incorrect boundary conditions in the Graphics component
* CVE-2026-16370:
Mitigation bypass in the DOM: Networking component
* CVE-2026-16371:
Privilege escalation in the DOM: Navigation component
* CVE-2026-16372:
Privilege escalation in the DOM: Content Processes component
* CVE-2026-16373:
Information disclosure in the Privacy component in Firefox
for Android
* CVE-2026-16374:
Information disclosure in the Framework component in DevTools
* CVE-2026-16375:
Site isolation issue in the Networking: HTTP component
* CVE-2026-16376:
Denial-of-service in the Graphics: WebGPU component
* CVE-2026-16377:
Mitigation bypass in the PDF Viewer component
* CVE-2026-16378:
Other issue in the DOM: Copy & Paste and Drag & Drop
component
* CVE-2026-16379:
Privilege escalation in the DOM: Content Processes component
* CVE-2026-16358:
Site isolation issue in the Graphics: WebRender component
* CVE-2026-16380:
Mitigation bypass in the Networking component
* CVE-2026-16381:
Same-origin policy bypass in the Networking: DNS component
* CVE-2026-16382:
Mitigation bypass in the DOM: Service Workers component
* CVE-2026-16383:
Mitigation bypass in the DOM: Networking component
* CVE-2026-16384:
Information disclosure due to uninitialized memory in the
Graphics: WebGPU component
* CVE-2026-16385:
Information disclosure due to uninitialized memory in the
Graphics: WebGPU component
* CVE-2026-16386:
Information disclosure due to uninitialized memory in the
Graphics: WebGPU component
* CVE-2026-16387:
Site isolation issue in the Networking component
* CVE-2026-16388:
Sandbox escape in the DOM: Networking component
* CVE-2026-16389:
Incorrect boundary conditions, integer overflow in the
Libraries component in NSS
* CVE-2026-16390:
Mitigation bypass in the Enterprise Policies component
* CVE-2026-16391:
Information disclosure in the Storage: IndexedDB component
* CVE-2026-16392:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16393:
Incorrect boundary conditions in the Graphics: WebGPU
component
* CVE-2026-16359:
Incorrect boundary conditions in the Audio/Video: GMP
component
* CVE-2026-16394:
Mitigation bypass in the DOM: Security component
* CVE-2026-16395:
Integer overflow in the Audio/Video component
* CVE-2026-16396:
Privilege escalation in WebExtensions
* CVE-2026-16397:
Clickjacking issue in the WebExtensions component in Firefox
for Android
* CVE-2026-16398:
Site isolation issue in the Graphics component
* CVE-2026-16399:
Site isolation issue in the DOM: Navigation component
* CVE-2026-16400:
Information disclosure in the DOM: Security component
* CVE-2026-16401:
Privilege escalation in the Data Loss Prevention component
* CVE-2026-16402:
Integer overflow in the Graphics: ImageLib component
* CVE-2026-16403:
Spoofing issue in the Address Bar component
* CVE-2026-16404:
Spoofing issue in Firefox for Android
* CVE-2026-16405:
Information disclosure in the Networking: WebSockets
component
* CVE-2026-16406:
Mitigation bypass in the Networking component
* CVE-2026-16407:
Mitigation bypass in the DOM: Service Workers component
* CVE-2026-16408:
Integer overflow in the Audio/Video: Playback component
* CVE-2026-16409:
Invalid pointer in the Security: PSM component
* CVE-2026-16410:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16411:
Memory safety bugs fixed in Firefox 153
* CVE-2026-16412:
Memory safety bugs fixed in Firefox ESR 140.13 and Firefox
153
* CVE-2026-16360:
Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR
140.13 and Firefox 153
* Fixed: Various security fixes.
MFSA 2026-76 (bsc#1274867):
* CVE-2026-74934:
Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935:
Privilege escalation in the DOM: Networking component
* CVE-2026-74936:
Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74939:
Privilege escalation in the DOM: Navigation component
* CVE-2026-74940:
Use-after-free in the Graphics: Text component
* CVE-2026-74941:
Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942:
Privilege escalation in the Remote Settings Client component
* CVE-2026-74943:
Use-after-free in the Graphics: ImageLib component
* CVE-2026-74944:
Use-after-free in the DOM: Core & HTML component
* CVE-2026-74945:
Information disclosure in the Graphics: Text component
* CVE-2026-74946:
Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component
* CVE-2026-74948:
Information disclosure in the Graphics component
* CVE-2026-74949:
Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
* CVE-2026-74953:
Privilege escalation in the Networking: Cookies component
* CVE-2026-74957:
Mitigation bypass in the Safe Browsing component
* CVE-2026-74959:
Mitigation bypass in the Storage: Cache API component
* CVE-2026-74960:
Site isolation issue in the WebExtensions component
* CVE-2026-74962:
Site isolation issue in the Networking: Cookies component
* CVE-2026-74963:
Same-origin policy bypass in the Networking: Cookies
component
* CVE-2026-74964:
Integer overflow in the Graphics component
* CVE-2026-74965:
Privilege escalation in the Shell Integration component
* CVE-2026-74967:
Same-origin policy bypass in the Audio/Video: Playback
component
* CVE-2026-74969:
Use-after-free in the Layout: Text and Fonts component
* CVE-2026-74971:
Information disclosure in the DOM: UI Events & Focus Handling
component
* CVE-2026-74972:
Information disclosure in the DOM: Push Subscriptions
component
* CVE-2026-74973:
Race condition, use-after-free in the Graphics component
* CVE-2026-74974:
Same-origin policy bypass in the Graphics: ImageLib component
* CVE-2026-74976:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-74983:
Mitigation bypass in the Data Loss Prevention component
* CVE-2026-74987:
Internally found bugs fixed in Firefox ESR 140.14, Firefox
ESR 153.1 and Firefox 154
* CVE-2026-74990:
Internally found bugs fixed in Firefox ESR 115.39, Firefox
ESR 140.14, Firefox ESR 153.1 and Firefox 154
Changes in rust-cbindgen:
- Update to version v0.29.4+git0:
* Bump version.
* tests: Add some tests for constant enums.
* ir: Add support for arrays.
* ir: Allow constant literals with enum variants.
* ir: Use Path for ConstExprs.
* Bump version to 0.29.3 and update CHANGES doc
* tests: Fix tests with modern gcc.
* Use C++ fixed-type enumeration syntax under C23 (or higher) as well
* Allow `pub` access to `ReprType` fields
- Update to version 0.29.2+git0:
* ci: Add a meta job to block the merge queue on it.
* Check for CMSE ABI's as well
* Fix doc attribute parsing to properly handle block comments
* Expose the line_endings config option to use with the builder
* fix env in workflow file
* use env to pass output parameters
* Explicitly request serde's std features to avoid issues with newer toml versions.
* Account for master -> main rename.
* Update changelog and bump version.
* enum: Track dependencies properly in enumerations.
- Update to version 0.29.2+git0:
* Explicitly request serde's std features to avoid issues with newer toml versions.
* Account for master -> main rename.
* Update changelog and bump version.
* enum: Track dependencies properly in enumerations.
* Allow must_use if a reason is specified
* constant: Handle cfg in associated constants.
* tests: Add a test for bitflags + disjoint cfg.
* Remove 'display' feature from the toml crate
* DOC: Add metatensor
* Fix #1085 - Incorrect detection of duplicated constants
* chore: More clippy fixes.
* docs: Correct after_include type in example config
* cargo update
* cfg: Remove another clippy warning.
* Fix `clippy::uninlined_format_args`
* Update toml to 0.9
* Release 0.29.0
* Support no-export annotation for statics and functions.
* conditional fields of constexpr literal structs
* Add LiteralStructField
* Github action: Add aarch64 to deploy
* Add rename rule for generated associated constant
* Upgrade heck to 0.5
* Add support for an optional nullable attribute
* docs.md: Fix deprecated_with_note and deprecated_variant_with_note being spelled as 'notes'
* Fix generic with 'void' default
* The return of Cast is simplified
* Added tests for as keyword inside array into structs
* Fixed error generation of structures using the keyword of as inside arrays
* Added test for unsafe(no_mangle) attribute
* Added tests for unsafe methotd's atributs
* Fixed handling of trait methods containing the unsafe attribute
* Rename -Zparse-only
* Release 0.28.0
* tests: Fix symbol file and tests.
* Appease clippy.
* tests: Run rustfmt.
Changes in mozilla-nspr:
- update to NSPR 4.39
* Improved error handling in PR_CreateThread on Windows
* Cleanup and Type-cast fixes for prtime
* Remove unused prstreams C++ wrapper from NSPR
* Memory poisoning and Arena redzone fixes
* Removed emacs/vim modelines and .cvsignore files
* Added .editorconfig
- update to version 4.38.2
* Fixed a syntax error in test file parsetm.c, which was
introduced in 4.38.1
- update to version 4.38.1
* Incorrect time value produced by PR_ParseTimeString and
PR_ParseTimeStringToExplodedTime if input string doesn't
specify seconds.
- update to version 4.38
* Removed support for HPUX and _PR_POLL_WITH_SELECT
* Fixed a bug in pt_TCP_SendTo on macOS
* Ensure parameter passed to isalpha() is unsigned char
- update to version 4.37
* PR_GetUniqueIdentity asserts on the 32767th call
* error LNK2019: unresolved external
symbol _InterlockedCompareExchange
* initclk deadline elapsed macOS
* Remove prwin.h (formerly known as prwin16.h)
* Use builtin atomic functions on RISC-V32/64
* PR_FormatTimeUSEnglish() doesn't support '%e'
format specifier
Changes in MozillaFirefox-branding-SLE:
- use suse_version for SLE16 (bsc#1273243)
- chage version to 153
- Switch to using xdg-desktop-portal file picker everywhere
for SLE-16 and later (bsc#1226112)
Changes in mozilla-nss:
- Fix potential crash in FIPS checks on PBKDF2 password checking (boo#1279863)
- Fix upper bound to allow FIPS approval for P-521.
- Approve HKDF and key concatenation in the context of TLS. This enables approved TLS
1.3 channels with PQC (bsc#1262698).
- Don't consider unapproved algorithms for TLS 1.3 in FIPS mode.
- Mark TLS 1.2 KDF without extended master secret non-approved for FIPS (bsc#1266262).
- Add patch to prefer any hybrid PQC and send at most one hybrid key share
(bsc#1262698).
- Add a notice to the module ID when it's in non-FIPS mode (bsc#1266263).
- Import ML-DSA implementation and related PQC fixes from upstream (bsc#1262698, bsc#1272772).
- Add power-on self-tests (KATs) for ML-KEM and ML-DSA (bsc#1272773).
- Add zeroization for ML-KEM, ported from upstream (bsc#1272774).
- Add zeroization for ML-DSA (bsc#1272774).
- nss-ml-dsa-test-fixes.patch: Add ML-DSA robustness and test fixes.
- Add PQC algorithms to approved list. Increase approved symmetric keygen floor to 112
bits (bsc#1262698). Approve non-NSS-aliased TLS 1.2 mechanisms
(bsc#1266262).
- Apply jitter enablement unconditionally (bsc#1262701).
- update to NSS 3.125
* Set nssckbi version to 2.88.
* Add Cybertrust Japan SecureSign Root CA16.
* Remove Email Trust bit from TrustAsia Global Root CA G3 and G4.
* Remove Entrust Root Certification Authority.
* Remove SecureSign Root CA12.
* Initialize ssl3.hs.echOuterExtensions in ssl_NewSocket.
* replace references to nss-dev/nss with mozilla/nss.
* limit recursion depth in CMS decoder.
* clamp input.len to testString size in pk11_mergeSecretKey.
* NULL pointer dereference in CERT_MergeExtensions.
* CERT_DecodeAVAValue — Integer Overflow in Output Buffer Sizing.
* fix two integer overflows on LLP64 systems.
* Modify an assertion in ssl3_ClientSendAppProtoXtn.
* Import RSA-PSS PKCS#8 private keys.
* Add EC Derive fuzz target.
* Update fuzz/config/tstclnt_arguments.py.
* Add DSAU fuzz target.
* Update ASN1 mutators for fuzzing.
* Update TLS mutators for fuzzing.
* Update TLS certs for fuzzing.
* Update TLS config for fuzzing.
* Extend QuickDER fuzz target.
* Extend PKCS12 fuzz target.
* Extend PKCS8 fuzz target.
* Extend certDN fuzz target.
* Update ASN1 fuzz target.
* Extend PKCS7 fuzz target.
* Bounds-check wrap index in PK11_GetWrapKey to match PK11_SetWrapKey.
* Adding a guard against integer overflow in AESKeyWrap_EncryptKWP.
* Add an integer overflow guard in UpdateBase64Decoder.
* Void out the fd.release in reconfig tests.
* make sftk_FindAttribute return a copy.
* Converted nss parameter schema from voluptuous to msgspec.
* bmo#311577 - drop slot monitor in PK11_ResetToken before calling PK11_InitToken.
* adjust the code to use nspr from github.
* avoid deadlock when PK11_IsLoggedIn is called from PK11_DoPassword.
* test pk11auth.c functions with a non-threadsafe module.
* bmo#311577 - PK11_InitPin sets slot->lastLoginCheck without holding the slot monitor.
* reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
* validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen.
* guard space subtraction in ssl_CallCustomExtensionSenders.
* rewrite labelLen bound in tls13_HkdfExpandLabelGeneral to avoid unsigned overflow.
* bound usageCount in PK11_UnwrapPrivKey to keyTemplate capacity.
* Set tail pointer to null in static slot lists when deallocating.
* avoid leaving a dangling ss->sec.ci.sid on allocation failure.
* guard against integer overflow in CERT_Hexify.
* Reject empty SECItem inputs in sftk_IsSafePrime before indexing data[len-1].
* NUL-terminate within filename field in jar_listtar to bound the filename scan.
* Widen CERT_FormatName length accumulator from unsigned to size_t.
* Bound IKE PRF nonce lengths to prevent CK_ULONG to unsigned int truncation.
* Drop companion arrays on length mismatch in NSS_CMSArray_Sort instead of asserting.
* Operate on a NUL-terminated copy in jar_parse_any to keep manifest scans bounded.
* Reject MD2 contexts with unusedBuffer > MD2_BUFSIZE in Update and End.
* Reserve NUL terminator for CKA_NSS_URL in nssCKObject_GetAttributes.
* Guard padding read against empty output in SEC_PKCS7DecryptContents.
* Guard against keySize overflow in IKE PRF/PRF+ output sizing.
* Allocate values array when overwriting an empty CMS attribute.
* Validate CKA_TOKEN attribute size in nssCKFWObject_SetAttribute.
* Validate CKA_CERTIFICATE_TYPE ulValueLen in nss_cert_type_from_ck_attrib.
* Handle zero-length input in PrepareBitStringForEncoding.
* Length-check raw_manifest before PORT_Strncasecmp prefix dispatch in JAR_parse_manifest.
* Reject CKA_NSS_MODULE_SPEC values that aren’t NUL-terminated within ulValueLen.
* Reject negative PR_Read returns in JAR_digest_file and jar_create_pk7.
* Update Bogo tests to 3fff7111b0eca817466e121059cb4e8b67ade35b.
* doc: import NSS:TryServer wiki page in the tree.
* improve PK11 URI tests.
* avoid nested attributeLock acquisition in sftk_CopyObject.
* doc: fix a typo in “Community — Network Security Services (NSS)â€.
* acquire RWLock before key copies in ssl_SetSelfEncryptKeyPair.
* Reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
* require non-null session pointer in sftk_GetContext.
* set session->lastOpWasFIPS while holding session reference.
* atomically claim object removal in sftk_DeleteObject.
* atomically swap session search in NSC_FindObjects*.
* atomically install session contexts in C_*Init.
* hold session reference for context lifetime in C_*Update.
* align softoken session lock with head-bucket hash.
* restore reference counting for SFTKSession.
- update to NSS 3.124
* Add test for PKCS7 digest array alignment
* Add test for rejection of excessively large ASN.1 SEQUENCE OF in quickder
* Add test for CMS content size validation
* Add regression tests for DSAU signature decoding
* Add test for S/MIME profile lookup on temp certs
* Test case for post-handshake auth and many certificate requests
* Add test for intra-arena ASan redzones
* update nss_status flags one at a time
* add defensive info->len check in PK11_HPKE_SetupS and PK11_HPKE_SetupR
* avoid PORT_Strdup in ssl_DecodeResumptionToken
* add runtime check on decoded resumption token session id
* improve mach try error handling
* clang format
* add comprehensive SECItem and SECItemArray tests
* add bugzilla_cf_status_nss.py script
* regenerate some recent release notes
* fix bug list output by release note and email scripts
* test removal from trust domain email cache
* fix 'testing if key corruption is detected in attribute' failures with sqlite-3.53.0
* build sqlite3 shell for Windows CI runners
* avoid race with module unloading in NSSTrustDomain_FindTokensByURI
* add ImportEd25519WithNonEmptyAlgorithmParams test
* add CLAUDE.md and .mcp.json
* add a mach try command
* remove dead condition in sec_asn1d_check_and_subtract_length
* avoid integer truncation in nssCKObject_GetAttributes
* add defensive input validation to sftk_compute_ANSI_X9_63_kdf
* avoid refcount over-release in nssTokenObjectCache error path [@ nssToken_Destroy]
* sdb: enforce that metaData's id key is unique when reading
* improve handling of escape sequences in pk11uri_ParseAttributes
* use correct data for ID comparison in transfer_uri_certs_to_collection
* fix truncation of ulValueLen in sdb_FindObjectsInit
* reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max
* set previous-nss-release for abicheck
* Skip `PR_Sleep` yield for non-blocking sockets in `ssl3_SendApplicationData`
* consistently protect PK11SlotInfo::maxKeyCount with freeListLock
* Remove CRMF from testing and manifests
* Remove unused RSA blind signature implementation from freebl
- update to NSS 3.123.1
* reject DTLS 1.3 Server Hello after HVR without
capping ss->vrange.max
- update to NSS 3.123
* https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- update to NSS 3.122.2:
* reject DTLS 1.3 Server Hello after HVR without
capping ss->vrange.max
- update to NSS 3.122.1
* improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
* Improving the allocation of S/MIME DecryptSymKey.
* store email on subject cache_entry in NSS trust domain.
* Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
* Improve size calculations in CMS content buffering.
* avoid integer overflow while escaping RFC822 Names.
* Reject excessively large ASN.1 SEQUENCE OF in quickder.
* Deep copy profile data in CERT_FindSMimeProfile.
* Improve input validation in DSAU signature decoding.
* avoid integer overflow in RSA_EMSAEncodePSS.
* Add a maximum cert uncompressed len and tests.
* Clarify extension negotiation mechanism for TLS Handshakes.
* make ss->ssl3.hs.cookie an owned-copy of the cookie.
- update to NSS 3.122
* ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
* run mach doc-lint from generate_release_doc.py.
* Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
* tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
* fix cipher spec count intermittent CI failures.
* fix Mlkem768x25519ShareDamager intermittent CI failures.
* lint the legacy documentation.
* lint the NSS 3.112.3 release notes.
* add a doc-lint CI job.
* Add more useful coverage reports to CI and fail if new commit isn't tested.
* wrong alert for malformed TLS 1.3 Finished.
* Swap order of asserts and state check.
* set correct value of unused curve parameters in tls13_HandleKeyShare.
* GCM needs to check for various limits in FIPS mode.
* Get Key Length not working from ED and Montgomery keys.
* Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
* fix intermittent ssl.sh test failures on windows runners.
* FIPS indicators on HKDF needs to be restricted to TLS usage.
* Generate keys not getting indicators.
* improve error handling in smime_init_once.
* Detect CPU features on OpenBSD using elf_aux_info.
* RSA_EMSAEncodePSS should validate the length of mHash.
* more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
* fix missing .S file error in Solaris Makefile builds.
* fix memory leak in NSC_GenerateKey error path.
* Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
* release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
* release 1stHandshakeLock on SSL_ResetHandshake error path.
* avoid null deref in mp_div_d sign normalization.
* Temp private key lifecycle is broken.
* protect rwSessionCount with slotLock.
* Remove invalid PORT_Free().
* Fix intermittent ClientGreaseKeyShare test failure.
* Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
* patch upstream acvp-rust during checkout to avoid build failures.
* update acvp Dockerfile.
* CKA_PARAM_SET missing from the CK_ULONG list in softoken.
* CKA_SEED missing from isPrivate in the database.
* update abicheck expectation for __nss_InitLock.
* taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
* tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
* tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
* tests: add native_path helper for cross-platform path conversion.
* tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
* avoid platform GCM for x64 iOS emulator builds.
* remove lock instrumentation feature.
* Move FIPS indicator structures out of fips_algorithms.h.
* all.sh is failing in FIPS SSL test in main tree.
* fix memory leaks in crmf tests.
* fix unsatisfiable condition in lg_getTrust.
* allow selfserv makefile build to use system zlib.
* Add allocation limit to pkcs12 decoding.
* Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
due to upstreamed FIPS patches
- update to NSS 3.121
* update vendored zlib to v1.3.2.
* Revert the unnecessary changes to intel-gcm-wrap.gyp.
* Use C fallback for AES-GCM on MinGW builds.
* fix ML-KEM PCT.
* Extend NSS Fuzzing docs.
* avoid integer overflow in platform-independent ghash.
* Fix errant whitespace in OISTE Server Root RSA G1 nickname.
* fix build with glibc-2.43 assignment discards 'const'
qualifier from pointer.
* add gcm.gyp dependency for Solaris SPARC builds.
* Set nssckbi version to 2.84.
* Add e-Szigno TLS Root CA 2023 to NSS.
* allow manual selection of CPU_ARCH=x86_64 and ppc64
in coreconf/Darwin.mk.
* Update cryptofuzz version.
* Paranoia assert.
* Darwin compatibility for intel-aes.S and intel-gcm.S.
* rename intel-{aes,gcm}.s to .S.
* rename C files for platform-specific ghash implementations.
* simplify compilation of platform-specific GCM and GHASH.
* FORWARD_NULL null deref of worker in p7decode.c
(sec_pkcs7_decoder_abort_digests).
* Out-of-Bounds Read in ML-DSA Private Key Parsing
(zero-length privateKey).
- update to NSS 3.120.1
* no upstream releasenotes
- update to NSS 3.120
* Fix docs generation bug.
* CID 1678226: Dereferencing null pointer plaintext.data().
* Run PKCS12 fuzz target with --fuzz=tls in CI.
* Allowing RT be started several times.
* move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs
- update to NSS 3.119.1
* restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
* Fix ml-dsa return value for SECKEY_PrivateKeyStrengthInBits.
* Make sure we don't accept ECH if the HRR cookie is ill-formatted.
* Add a pkcs12 fuzzer with crypto stubbed out.
* handle errors while setting sanitizers cflags in build.
* Ignore IVs for AES KW.
* Update Cryptofuzz version.
* Fix incorrect logic for SNI selection when ECH is available but disabled.
* fix forwarding of sqlite_libs in sqlite.gyp.
* fix CPU_ARCH setting for arm64 makefile builds.
* remove unused calcThreads variable from cmd/rsaperf.
* Solving the incorrect tests introduced by extending EKU.
* Memory leaks in pkcs12 and pkcs7 decoders.
* Extending parsing with Microsoft Document Signing EKU.
* Extending parsing with Adobe Document Signing EKU.
* Extending pkix parsing with document signing EKUs.
* fix compilation failure on ia32.
* use hardware x64 GCM in static builds.
* separate ppc sha512 library from ppc gcm library.
* simplify cross-compilation from build.sh.
* use clang's integrated assembler.
* remove unused MP_IS_LITTLE_ENDIAN defines.
* fix logic for disabling altivec in gyp builds.
* free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
* Add TLS interoperability tests with openssl and gnutls.
* Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
* add failure checks to pk11_mergeTrust() .
* pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream
- update to NSS 3.118.1
* pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
* Remove four Commscope root certificates from NSS
* fix try pushes with --nspr-patch to actually apply the patch
* Support for NIST Curves compressed points
* Destroy certificate on error paths
* Move NSS DB password hash away from SHA-1
* support secp384r1mlkem1024
* vendor latest ML-KEM code from libcrux
* add mlk-kem-1024 tests
* use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
* Move scripts to python3
* add mlkem1024 support in freebl
* support secp256r1mlkem768
* Make mlkem768x25519 the default
* ML-DSA SGN and VFY interfaces
* Align FIPS interfaces count with array
* Ensure CKK_ML_KEM has derive CK_FALSE
* Add script for tagging an NSS release
* Remove the globals from nss-release-helper.py
* Add release helper command for generating the release index
* Add release helper command for generating a release note
* Add release helper command for freezing a branch
- update to NSS 3.117
* fix memory leak in secasn1decode_unittest.cc
* Add OISTE roots
* Add runbook for certdata.txt changes
* dbtool: close databases before shutdown
* SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
* don’t flush base64 when buffer is null
* Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
* mozilla::pkix: recognize the qcStatements extension for QWACs
* Fix a big-endian-problematic cast in zlib calls
* Revert removing out/ directory after ossfuzz build
* Add Cryptofuzz to OSS-Fuzz build
* Add PKCS#11 trust tests
* final disable dsa patch cert.sh
* ml-dsa: move tls 1.3 to use streaming signatures
* ml-dsa: Prep Create a FindOidTagByString function
* ml-dsa: softoken changes
* ml-dsa: der key decode
* ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
* ml-dsa: Prep Create a CreateSignatureAlgorithmID function
- update to NSS 3.116
* disable DSA in NSS script tests
* Disabling of some algorithms: generic cert.sh
* Need to update to new mechanisms
* Add ML-DSA public key printing support in NSS command-line utilities
* note embedded scts before revocation checks are performed
* Add support for ML-DSA keys and mechanisms in PKCS#11 interface
* Add support for ML-DSA key type and public key structure
* Enable ML-DSA integration via OIDs support and SECMOD flag
* disable kyber
* Implement PKCS #11 v3.2 PQ functions (use verify signature)
* Disable dsa - gtests
* make group and scheme support in test tools generic
* Create GH workflow to automatically close PRs
* Disable dsa - base code
* Disabling of some algorithms: remove dsa from pk11_mode
* Disable seed and RC2 bug fixes
* restore support for finding certificates by decoded serial number
* avoid CKR_BUFFER_TO_SMALL error in trust lookups
* lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
* Use PKCS #11 v3.2 KEM mechanisms and functions
- update to NSS 3.115.1
* restore support for finding certificates by decoded serial number.
* avoid CKR_BUFFER_TO_SMALL error in trust lookups.
- update to NSS 3.115
* CID 1648399 - Resource leak in shlibsign.c
* CKA_SEED needs to be marked as a private attribute
* Fix bad syntax on Windows in softoken_gtest.cc
* Key private/public/secret keys by key type in softoken keydb
* add PK11_HPKE_GetSharedSecret to abi-check expected report
* remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
* Fixup ABI
* add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
* ECH fuzz target
* Implement PKCS #11 v3.2 FIPS indicator and validation objects
* remove expired explicitly distrusted DigiNotar lookalike root
* Implement PKCS #11 v3.2 functions
- update to NSS 3.114
* NSS 3.114 source distribution should include NSPR 4.37
* Prevent leaks during pkcs12 decoding
* Remove redundant assert in p7local.c
* Bump nssckbi version to 2.80
* Remove expired Baltimore CyberTrust Root
* Add TrustAsia Dedicated Roots to NSS
* Add SwissSign 2022 Roots to NSS
* Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
* Implement PKCS #11 v3.2 trust objects in softoken
* Implement PKCS #11 v3.2 trust objects - nss proper
* remove dead code in ssl3con.c
* DTLS (excl DTLS1.3) Changing Holddown timer logic
* Bump nssckbi version to 2.79
* remove unneccessary assertion
* Update mechanisms for Softoken PCT
* convert Chunghwa Telecom ePKI Root removal to a distrust after
* Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
* use -O2 for asan build
* Fix leaking locks when toggling SSL_NO_LOCKS
* remove out-of-function semicolon
* Extend pkcs8 fuzz target
* Extend pkcs7 fuzz target
* Remove unused assignment to pageno
* Remove unused assignment to nextChunk
* don't run commands as part of shell `local` declarations
* fix sanitizer setup
* don't silence ssl_gtests output when running with coverage
* Release docs and housekeeping
* migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work
- update to NSS 3.113
* Fix alias for mac workers on try.
* bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
* Bump nssckbi version to 2.78.
* Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
* fix frame pointers in intel-gcm.s.
* Typo in release notes for NSS 101.4.
* Improve nss-release-helper.py.
* shlibsign is broken in System FIPS mode.
* Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
* PKCS #11 v3.2 header files.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4176-1
Released: Mon Sep 14 12:29:48 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
- update to 2.5.2:
* attr: eliminate a dead store in attr_copy_action()
* libattr: Set symbol versions for legacy syscalls via attribute
or asm
* exports: use LGPL for library code
* documentation updates
* translation updates (Polish, Dutch, Gregorian, French)
* build system updates
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4205-1
Released: Wed Sep 16 10:20:20 2026
Summary: Security update for lcms2
Type: security
Severity: low
References: 1264994,CVE-2026-41254
This update for lcms2 fixes the following issue:
- CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4241-1
Released: Thu Sep 17 13:48:51 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4250-1
Released: Thu Sep 17 18:00:36 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1267610,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4394-1
Released: Tue Sep 29 13:52:17 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base
Type: security
Severity: important
References: 1273856,1273857,1277883,1278008,1280125,1282491,1282492,1282505,1282639,1282640,1282641,1282645,CVE-2026-18401,CVE-2026-19032,CVE-2026-68494,CVE-2026-68495,CVE-2026-68496,CVE-2026-68497,CVE-2026-68498,CVE-2026-83557,CVE-2026-89407,CVE-2026-89425,CVE-2026-91776,CVE-2026-91777
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues
(bsc#1273856).
- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for
unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
Changes for jackson-annotations:
- Update to 2.18.11
Changes for jackson-bom:
- Update to 2.18.11
Changes for jackson-core:
- Update to 2.18.11
* #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,
CVE-2026-89407)
* #1698: UTF8DataInputJsonParser does not honor
maxErrorTokenLength when reporting an unrecognized token
(bsc#1282505, CVE-2026-89425)
* #1642: Fix maxDocumentLength bypass in async parser
single-feedInput() case [GHSA-2c4j-63jj-9fqr]
* #1643: Enforce maxNameLength incrementally in
ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)
of async parser (bsc#1273857, CVE-2026-68494)
non-blocking (async) parser (bsc#1273856, CVE-2026-18401)
Changes for jackson-databind:
- Update to 2.18.11
* #6185: Bracket unresolved IPv6 host name in InetSocketAddress
serialization
* #6203: Prevent unbounded growth of type id cache in
TypeDeserializer (bsc#1282491, CVE-2026-91776)
* #6204: Avoid quadratic forward-reference resolution in
Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
* #6099: Resolve classes without initialization in
TypeFactory.findClass()
* #6116: Reject non-ASCII digits in InetAddress literal validation
* #6127: Add StreamReadConstraints number len constraint to
javax.xml.datatype.XMLGregorianCalendar and
javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
* #6129: Limit the supported URL schemes for java.nio.file.Path
deserialization (bsc#1277883, CVE-2026-19032)
* #6156: Add java.lang.Comparable in set of unsafe polymorphic
base types (bsc#1278008, CVE-2026-83557)
* #6165: Apply number length limits to BigDecimal/BigInteger/
/Double/Float Map keys
Changes for jackson-dataformat-xml:
- Update to 2.18.11
* Fix build to avoid past-JDK-8 bytecode generation
* #891: Enforce StreamReadConstraints.maxNestingDepth in
FromXmlParser
Changes for jackson-dataformats-binary:
- Update to 2.18.11
* #783: (protobuf) Support StreamReadConstraints.maxDocumentLength
in ProtobufParser
* #785: (avro) Support StreamReadConstraints.maxDocumentLength and
maxTokenCount in Avro parser
* #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion
parser (partial fix for #358)
* #805: (ion) Support StreamReadConstraints.maxDocumentLength in
Ion parser (partial fix for #358)
* #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser
(bsc#1282639, CVE-2026-68495)
* #726: (smile) Ensure maxNameLength limit enforced for Smile
parser (bsc#1282640, CVE-2026-68496)
* #727: (cbor) CBORParser.nextFieldName(SerializableString)
confuses 5-bit length marker 23 with 24 ('1-byte length suffix
follows')
* #728: (cbor) CBORParser.nextFieldName(SerializableString)
consumes Object entry slot twice on fast-path miss, truncating
definite-length Objects
* #733: (cbor) Long `String`s not added to 'stringref' reference
table, breaking following references
* #735: (cbor) 'stringref' property-name paths pass 5-bit length
marker instead of actual length to shouldReferenceString()
* #736: (cbor) Long Object property names added to 'stringref'
reference table twice
Changes for jackson-modules-base:
- Update to 2.18.11
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4414-1
Released: Fri Oct 2 09:37:26 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,1281125,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
Other non-security fixes:
- Add a conflicts with previous crypto-policies versions (bsc#1281125)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4571-1
Released: Thu Oct 8 10:02:12 2026
Summary: Maintenance update for Multi-Linux Manager 5.2: Server, Proxy and Retail Branch Server
Type: security
Severity: important
References: 1208800,1230568,1230949,1252286,1257151,1258382,1258500,1258567,1259225,1260342,1262157,1263822,1265219,1265472,1266481,1267261,1267871,1267912,1268228,1268325,1268473,1268587,1268673,1268755,1269192,1269253,1269316,1269534,1269679,1270033,1270039,1270040,1270047,1270141,1270694,1271075,1271116,1271124,1271329,1271332,1271382,1271467,1271523,1271678,1271681,1271841,1271902,1271963,1272298,1272392,1272404,1272538,1272621,1272988,1273073,1273131,1273144,1273846,1273853,1274023,1274227,1274613,1274720,1274775,CVE-2026-39821,CVE-2026-63007,CVE-2026-63009,CVE-2026-71400
Maintenance update for Multi-Linux Manager 5.2: Server, Proxy and Retail Branch Server
This is a codestream only update
The following package changes have been done:
- crypto-policies-20250714.cd6043a-150700.6.4.2 updated
- glibc-2.38-150600.14.58.1 updated
- libpcre2-8-0-10.42-150600.3.3.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libbz2-1-1.0.8-150400.3.4.1 updated
- libattr1-2.6.0-150000.4.3.1 updated
- libacl1-2.4.0-150000.4.6.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- libgcrypt20-1.11.0-150700.5.10.1 updated
- libopenssl3-3.5.0-150700.5.53.2 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.53.2 updated
- openssl-3.5.0-150700.3.4.1 updated
- openssl-3-3.5.0-150700.5.53.2 updated
- libasound2-1.2.10-150600.4.3.1 updated
- libfreebl3-3.125-150400.3.74.1 updated
- liblcms2-2-2.15-150600.3.6.1 updated
- libpng16-16-1.6.58-150600.3.23.1 updated
- mozilla-nspr-4.39-150400.12.3.1 updated
- snpguest-0.10.0-150700.3.6.1 updated
- libsystemd0-254.27-150600.4.71.2 updated
- mozilla-nss-certs-3.125-150400.3.74.1 updated
- mozilla-nss-3.125-150400.3.74.1 updated
- libsoftokn3-3.125-150400.3.74.1 updated
- mozilla-nss-sysinit-3.125-150400.3.74.1 updated
- java-17-openjdk-headless-17.0.20.1-150400.3.72.1 updated
- stax2-api-4.3.0-150200.3.8.1 added
- jackson-core-2.18.11-150200.3.30.1 updated
- jackson-annotations-2.18.11-150200.3.28.1 updated
- woodstox-core-7.2.1-150200.3.10.1 added
- jackson-databind-2.18.11-150200.3.36.1 updated
- jackson-dataformat-xml-2.18.11-150200.5.8.1 added
- log4j-2.26.1-150200.4.42.1 updated
- uyuni-java-common-5.2.7-150750.3.3.5 updated
- uyuni-coco-attestation-core-5.2.7-150750.3.3.5 updated
- uyuni-coco-attestation-module-snpguest-5.2.7-150750.3.3.5 updated
- uyuni-coco-attestation-module-secureboot-5.2.7-150750.3.3.5 updated
- container:bci-bci-base-15.7-639cc27d64fa2f2a457d7b6d4dbdd89247dbfd872ad438f5a1799fb085c6c720-0 updated
More information about the sle-container-updates
mailing list