SUSE-CU-2026:12094-1: Security update of suse/multi-linux-manager/5.2/x86_64/server
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Oct 9 09:14:23 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.2/x86_64/server
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12094-1
Container Tags : suse/multi-linux-manager/5.2/x86_64/server:5.2.1 , suse/multi-linux-manager/5.2/x86_64/server:5.2.1.11.5.1 , suse/multi-linux-manager/5.2/x86_64/server:latest
Container Release : 11.5.1
Severity : critical
Type : security
References : 1183870 1207866 1208800 1212476 1216950 1220279 1226112 1227370
1230568 1230949 1232390 1236136 1236165 1236599 1239009 1240054
1240955 1242233 1243014 1243459 1243564 1243830 1245862 1246013
1246570 1247463 1247539 1250110 1250233 1250234 1252286 1252306
1252696 1253025 1253043 1253777 1254340 1254341 1254702 1254738
1254867 1254960 1254982 1254984 1255451 1255764 1256070 1256709
1256829 1256831 1256832 1256833 1257151 1257249 1257274 1257383
1257463 1258069 1258311 1258382 1258500 1258567 1259132 1259225
1259520 1259542 1259652 1259804 1259825 1260342 1260421 1260998
1261002 1261003 1261038 1261166 1261400 1261606 1261678 1261969
1261982 1261983 1262098 1262157 1262305 1262315 1262319 1262631
1262632 1262633 1262635 1262636 1262638 1262654 1262684 1262698
1262701 1263083 1263254 1263366 1263367 1263440 1263494 1263656
1263658 1263822 1263890 1264396 1264962 1264994 1264994 1265156
1265219 1265268 1265413 1265413 1265472 1265591 1265592 1265593
1265594 1265595 1265596 1265930 1265974 1266262 1266263 1266304
1266343 1266344 1266347 1266364 1266481 1266664 1266786 1267261
1267355 1267503 1267581 1267605 1267606 1267610 1267644 1267647
1267739 1267821 1267823 1267849 1267871 1267912 1267955 1267956
1267957 1267962 1267963 1267965 1267969 1267970 1267971 1267972
1267976 1267977 1267978 1268131 1268162 1268228 1268290 1268321
1268325 1268349 1268375 1268395 1268396 1268397 1268402 1268407
1268409 1268412 1268413 1268415 1268416 1268417 1268420 1268422
1268427 1268473 1268530 1268546 1268587 1268603 1268673 1268683
1268755 1268853 1268867 1268886 1268897 1268898 1268899 1268902
1268902 1268965 1268977 1269012 1269039 1269040 1269041 1269042
1269043 1269044 1269045 1269046 1269047 1269048 1269049 1269050
1269051 1269052 1269053 1269054 1269055 1269056 1269057 1269058
1269060 1269066 1269192 1269253 1269279 1269316 1269480 1269489
1269534 1269567 1269568 1269583 1269584 1269622 1269623 1269679
1269788 1269790 1269791 1269807 1269824 1269907 1269908 1269909
1269910 1269947 1269959 1270008 1270009 1270010 1270016 1270018
1270021 1270033 1270039 1270040 1270047 1270141 1270208 1270365
1270393 1270416 1270515 1270620 1270694 1270706 1270708 1270709
1270772 1270801 1270936 1270994 1271017 1271018 1271044 1271046
1271048 1271049 1271052 1271053 1271054 1271055 1271075 1271116
1271124 1271166 1271167 1271192 1271193 1271194 1271195 1271329
1271332 1271351 1271352 1271354 1271372 1271382 1271397 1271398
1271399 1271440 1271442 1271458 1271459 1271464 1271465 1271466
1271467 1271469 1271523 1271602 1271629 1271645 1271649 1271672
1271673 1271674 1271675 1271676 1271677 1271678 1271681 1271684
1271705 1271712 1271712 1271727 1271730 1271841 1271902 1271963
1271980 1271982 1271983 1271984 1271985 1271986 1271987 1271988
1271989 1271990 1272164 1272165 1272166 1272167 1272168 1272169
1272171 1272206 1272223 1272224 1272225 1272227 1272228 1272235
1272236 1272237 1272298 1272392 1272404 1272534 1272538 1272554
1272621 1272734 1272735 1272736 1272737 1272772 1272773 1272774
1272988 1273009 1273073 1273131 1273144 1273150 1273163 1273184
1273242 1273243 1273300 1273429 1273430 1273431 1273432 1273433
1273434 1273435 1273436 1273437 1273438 1273439 1273440 1273441
1273846 1273853 1273856 1273857 1273922 1273924 1273925 1274023
1274091 1274227 1274235 1274237 1274576 1274613 1274625 1274720
1274723 1274726 1274740 1274774 1274774 1274775 1274777 1274788
1274788 1274790 1274791 1274792 1274795 1274795 1274796 1274797
1274798 1274850 1274852 1274854 1274856 1274857 1274858 1274867
1274946 1274991 1275001 1275002 1275011 1275012 1275013 1275014
1275015 1275016 1275017 1275018 1275035 1275042 1275043 1275044
1275046 1275047 1275048 1275049 1275050 1275051 1275052 1275053
1275054 1275055 1275056 1275057 1275058 1275059 1275060 1275061
1275062 1275063 1275064 1275065 1275066 1275067 1275068 1275264
1275265 1275441 1275660 1275764 1275777 1275778 1275837 1275863
1275902 1276290 1276291 1276892 1276893 1276894 1276895 1276896
1276897 1276898 1276899 1276900 1276901 1276902 1276946 1277106
1277247 1277262 1277476 1277479 1277480 1277707 1277708 1277709
1277710 1277711 1277713 1277725 1277790 1277883 1277886 1277921
1277922 1278001 1278008 1278351 1278719 1278721 1278722 1278724
1278726 1278727 1278729 1279561 1279863 1279893 1280050 1280051
1280052 1280053 1280054 1280125 1280430 1280432 1280433 1280435
1280436 1280437 1280438 1280439 1280440 1280441 1280442 1280443
1280444 1280445 1280587 1280589 1280590 1280591 1280592 1280594
1280595 1280596 1280597 1280598 1280599 1280689 1280884 1280910
1280911 1281059 1281125 1281439 1281440 1281653 1281657 1281661
1281665 1281704 1282491 1282492 1282505 1282581 1282599 1282620
1282621 1282622 1282623 1282624 1282625 1282626 1282627 1282628
1282629 1282630 1282631 1282639 1282640 1282641 1282645 1282787
622430 CVE-2022-25147 CVE-2023-54397 CVE-2024-12797 CVE-2024-13176
CVE-2024-25629 CVE-2024-58384 CVE-2024-9143 CVE-2025-11187 CVE-2025-15444
CVE-2025-15468 CVE-2025-15469 CVE-2025-15661 CVE-2025-27587 CVE-2025-31498
CVE-2025-4575 CVE-2025-48924 CVE-2025-49506 CVE-2025-59529 CVE-2025-62408
CVE-2025-66199 CVE-2025-66471 CVE-2025-69277 CVE-2025-9231 CVE-2025-9232
CVE-2026-0864 CVE-2026-10536 CVE-2026-10723 CVE-2026-10822 CVE-2026-10879
CVE-2026-11331 CVE-2026-11605 CVE-2026-11622 CVE-2026-11721 CVE-2026-11850
CVE-2026-11940 CVE-2026-11972 CVE-2026-11979 CVE-2026-12064 CVE-2026-12087
CVE-2026-12610 CVE-2026-12617 CVE-2026-13204 CVE-2026-13321 CVE-2026-13595
CVE-2026-13608 CVE-2026-14380 CVE-2026-14456 CVE-2026-14457 CVE-2026-14474
CVE-2026-14476 CVE-2026-14662 CVE-2026-14663 CVE-2026-14664 CVE-2026-14666
CVE-2026-14668 CVE-2026-14669 CVE-2026-14670 CVE-2026-14671 CVE-2026-14672
CVE-2026-14673 CVE-2026-14676 CVE-2026-14677 CVE-2026-14678 CVE-2026-14679
CVE-2026-14680 CVE-2026-14681 CVE-2026-14740 CVE-2026-14741 CVE-2026-1502
CVE-2026-15043 CVE-2026-15308 CVE-2026-15392 CVE-2026-15588 CVE-2026-15741
CVE-2026-15742 CVE-2026-15779 CVE-2026-16238 CVE-2026-16239 CVE-2026-16241
CVE-2026-16349 CVE-2026-16350 CVE-2026-16351 CVE-2026-16352 CVE-2026-16353
CVE-2026-16354 CVE-2026-16355 CVE-2026-16356 CVE-2026-16357 CVE-2026-16358
CVE-2026-16359 CVE-2026-16360 CVE-2026-16362 CVE-2026-16363 CVE-2026-16364
CVE-2026-16365 CVE-2026-16366 CVE-2026-16367 CVE-2026-16368 CVE-2026-16369
CVE-2026-16370 CVE-2026-16371 CVE-2026-16372 CVE-2026-16373 CVE-2026-16374
CVE-2026-16375 CVE-2026-16376 CVE-2026-16377 CVE-2026-16378 CVE-2026-16379
CVE-2026-16380 CVE-2026-16381 CVE-2026-16382 CVE-2026-16383 CVE-2026-16384
CVE-2026-16385 CVE-2026-16386 CVE-2026-16387 CVE-2026-16388 CVE-2026-16389
CVE-2026-16390 CVE-2026-16391 CVE-2026-16392 CVE-2026-16393 CVE-2026-16394
CVE-2026-16395 CVE-2026-16396 CVE-2026-16397 CVE-2026-16398 CVE-2026-16399
CVE-2026-16400 CVE-2026-16401 CVE-2026-16402 CVE-2026-16403 CVE-2026-16404
CVE-2026-16405 CVE-2026-16406 CVE-2026-16407 CVE-2026-16408 CVE-2026-16409
CVE-2026-16410 CVE-2026-16411 CVE-2026-16412 CVE-2026-18024 CVE-2026-18374
CVE-2026-18401 CVE-2026-18408 CVE-2026-18798 CVE-2026-18917 CVE-2026-19032
CVE-2026-19033 CVE-2026-19385 CVE-2026-19499 CVE-2026-19542 CVE-2026-19662
CVE-2026-19666 CVE-2026-19667 CVE-2026-19668 CVE-2026-19941 CVE-2026-19953
CVE-2026-23679 CVE-2026-26032 CVE-2026-2673 CVE-2026-27448 CVE-2026-27456
CVE-2026-28390 CVE-2026-29167 CVE-2026-29170 CVE-2026-3039 CVE-2026-32327
CVE-2026-3276 CVE-2026-3276 CVE-2026-33630 CVE-2026-34181 CVE-2026-34182
CVE-2026-34191 CVE-2026-34355 CVE-2026-34356 CVE-2026-34501 CVE-2026-34502
CVE-2026-35189 CVE-2026-35191 CVE-2026-3592 CVE-2026-3593 CVE-2026-39821
CVE-2026-40226 CVE-2026-40355 CVE-2026-40356 CVE-2026-40467 CVE-2026-40468
CVE-2026-40553 CVE-2026-41066 CVE-2026-41254 CVE-2026-41254 CVE-2026-41676
CVE-2026-41677 CVE-2026-41678 CVE-2026-41681 CVE-2026-41898 CVE-2026-41989
CVE-2026-41991 CVE-2026-41992 CVE-2026-42250 CVE-2026-42327 CVE-2026-42535
CVE-2026-42536 CVE-2026-42764 CVE-2026-4360 CVE-2026-43951 CVE-2026-44119
CVE-2026-44185 CVE-2026-44186 CVE-2026-44605 CVE-2026-44631 CVE-2026-44662
CVE-2026-45409 CVE-2026-45409 CVE-2026-45784 CVE-2026-46917 CVE-2026-46968
CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059 CVE-2026-47063
CVE-2026-4786 CVE-2026-4873 CVE-2026-48913 CVE-2026-49853 CVE-2026-49854
CVE-2026-49855 CVE-2026-49975 CVE-2026-50031 CVE-2026-50229 CVE-2026-53404
CVE-2026-53434 CVE-2026-53612 CVE-2026-53613 CVE-2026-53614 CVE-2026-53783
CVE-2026-53784 CVE-2026-53785 CVE-2026-53786 CVE-2026-53788 CVE-2026-53789
CVE-2026-53790 CVE-2026-53791 CVE-2026-53792 CVE-2026-53793 CVE-2026-53794
CVE-2026-53795 CVE-2026-53796 CVE-2026-53797 CVE-2026-53798 CVE-2026-53799
CVE-2026-53800 CVE-2026-53801 CVE-2026-53802 CVE-2026-53803 CVE-2026-5435
CVE-2026-54369 CVE-2026-54370 CVE-2026-54371 CVE-2026-54411 CVE-2026-54512
CVE-2026-54513 CVE-2026-54514 CVE-2026-54515 CVE-2026-54515 CVE-2026-54872
CVE-2026-54874 CVE-2026-54874 CVE-2026-54875 CVE-2026-55199 CVE-2026-55276
CVE-2026-5545 CVE-2026-55955 CVE-2026-55956 CVE-2026-56109 CVE-2026-56288
CVE-2026-56289 CVE-2026-57053 CVE-2026-57062 CVE-2026-57432 CVE-2026-57585
CVE-2026-5773 CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013
CVE-2026-58014 CVE-2026-58016 CVE-2026-58050 CVE-2026-58051 CVE-2026-58055
CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222 CVE-2026-58224
CVE-2026-59083 CVE-2026-59084 CVE-2026-5946 CVE-2026-5947 CVE-2026-5950
CVE-2026-59843 CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847
CVE-2026-59848 CVE-2026-59850 CVE-2026-59856 CVE-2026-59857 CVE-2026-59858
CVE-2026-59884 CVE-2026-59885 CVE-2026-59886 CVE-2026-59888 CVE-2026-59889
CVE-2026-59995 CVE-2026-59996 CVE-2026-59997 CVE-2026-59998 CVE-2026-59999
CVE-2026-60000 CVE-2026-60001 CVE-2026-60002 CVE-2026-60081 CVE-2026-60082
CVE-2026-60147 CVE-2026-6019 CVE-2026-6019 CVE-2026-60589 CVE-2026-6100
CVE-2026-61308 CVE-2026-61477 CVE-2026-6238 CVE-2026-6253 CVE-2026-6276
CVE-2026-63007 CVE-2026-63009 CVE-2026-63072 CVE-2026-63072 CVE-2026-63073
CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-63622 CVE-2026-63623
CVE-2026-6368 CVE-2026-6429 CVE-2026-64607 CVE-2026-6464 CVE-2026-6469
CVE-2026-6470 CVE-2026-6471 CVE-2026-65182 CVE-2026-65183 CVE-2026-65637
CVE-2026-65905 CVE-2026-65927 CVE-2026-66032 CVE-2026-66033 CVE-2026-66034
CVE-2026-66035 CVE-2026-66299 CVE-2026-66422 CVE-2026-66484 CVE-2026-66485
CVE-2026-66486 CVE-2026-6791 CVE-2026-68494 CVE-2026-68495 CVE-2026-68496
CVE-2026-68497 CVE-2026-68498 CVE-2026-68525 CVE-2026-68569 CVE-2026-68742
CVE-2026-68743 CVE-2026-68744 CVE-2026-68763 CVE-2026-69184 CVE-2026-69186
CVE-2026-6949 CVE-2026-70452 CVE-2026-70453 CVE-2026-70454 CVE-2026-70455
CVE-2026-70456 CVE-2026-70457 CVE-2026-70458 CVE-2026-70459 CVE-2026-70460
CVE-2026-70461 CVE-2026-70462 CVE-2026-70463 CVE-2026-70464 CVE-2026-70907
CVE-2026-71400 CVE-2026-7168 CVE-2026-7210 CVE-2026-72693 CVE-2026-72897
CVE-2026-73070 CVE-2026-73071 CVE-2026-73072 CVE-2026-73074 CVE-2026-73075
CVE-2026-73076 CVE-2026-73077 CVE-2026-73078 CVE-2026-73180 CVE-2026-73581
CVE-2026-74934 CVE-2026-74935 CVE-2026-74936 CVE-2026-74937 CVE-2026-74938
CVE-2026-74939 CVE-2026-74940 CVE-2026-74941 CVE-2026-74942 CVE-2026-74943
CVE-2026-74944 CVE-2026-74945 CVE-2026-74946 CVE-2026-74947 CVE-2026-74948
CVE-2026-74949 CVE-2026-74950 CVE-2026-74952 CVE-2026-74953 CVE-2026-74954
CVE-2026-74955 CVE-2026-74956 CVE-2026-74957 CVE-2026-74958 CVE-2026-74959
CVE-2026-74960 CVE-2026-74961 CVE-2026-74962 CVE-2026-74963 CVE-2026-74964
CVE-2026-74965 CVE-2026-74966 CVE-2026-74967 CVE-2026-74968 CVE-2026-74969
CVE-2026-74970 CVE-2026-74971 CVE-2026-74972 CVE-2026-74973 CVE-2026-74974
CVE-2026-74976 CVE-2026-74977 CVE-2026-74978 CVE-2026-74979 CVE-2026-74981
CVE-2026-74982 CVE-2026-74983 CVE-2026-74984 CVE-2026-74985 CVE-2026-74986
CVE-2026-74987 CVE-2026-74988 CVE-2026-74990 CVE-2026-75029 CVE-2026-75803
CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-75874 CVE-2026-75973
CVE-2026-7598 CVE-2026-76163 CVE-2026-76183 CVE-2026-77117 CVE-2026-77119
CVE-2026-77159 CVE-2026-77692 CVE-2026-77696 CVE-2026-7774 CVE-2026-77756
CVE-2026-77762 CVE-2026-77791 CVE-2026-78030 CVE-2026-78301 CVE-2026-78383
CVE-2026-78437 CVE-2026-79677 CVE-2026-80229 CVE-2026-80230 CVE-2026-80274
CVE-2026-80489 CVE-2026-81563 CVE-2026-81736 CVE-2026-82397 CVE-2026-8286
CVE-2026-8328 CVE-2026-83557 CVE-2026-8368 CVE-2026-8376 CVE-2026-84118
CVE-2026-84119 CVE-2026-84120 CVE-2026-84121 CVE-2026-84122 CVE-2026-84123
CVE-2026-84124 CVE-2026-84125 CVE-2026-84129 CVE-2026-84130 CVE-2026-84131
CVE-2026-84132 CVE-2026-84133 CVE-2026-84134 CVE-2026-84136 CVE-2026-84137
CVE-2026-84139 CVE-2026-84140 CVE-2026-84141 CVE-2026-84143 CVE-2026-84144
CVE-2026-84145 CVE-2026-8458 CVE-2026-84782 CVE-2026-84784 CVE-2026-85504
CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509
CVE-2026-86145 CVE-2026-86243 CVE-2026-86246 CVE-2026-86247 CVE-2026-86248
CVE-2026-86350 CVE-2026-87022 CVE-2026-8829 CVE-2026-88806 CVE-2026-88807
CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161
CVE-2026-8924 CVE-2026-8926 CVE-2026-8927 CVE-2026-89407 CVE-2026-89425
CVE-2026-9079 CVE-2026-9080 CVE-2026-91776 CVE-2026-91777 CVE-2026-91990
CVE-2026-91991 CVE-2026-9375 CVE-2026-94283 CVE-2026-94284 CVE-2026-94285
CVE-2026-94286 CVE-2026-9545 CVE-2026-9547 CVE-2026-9698
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.2/x86_64/server was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2025:2763-1
Released: Tue Aug 12 14:45:40 2025
Summary: Optional update for libyaml
Type: optional
Severity: moderate
References: 1246570
This update for libyaml ships the missing libyaml-0-2 library package to
SUSE MicroOS 5.1 and 5.2.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2688-1
Released: Tue Jun 30 10:20:42 2026
Summary: Security update for sg3_utils
Type: security
Severity: important
References: 1267823
This update for sg3_utils fixes the following issue
- sg_inq: --export output conformance for SCSI name string and ATA fields (bsc#1267823).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2725-1
Released: Thu Jul 2 15:52:16 2026
Summary: Security update for python-tornado6
Type: security
Severity: important
References: 1268395,1268396,1268397,CVE-2026-49853,CVE-2026-49854,CVE-2026-49855
This update for python-tornado6 fixes the following issues
- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2673-1
Released: Thu Jul 2 17:04:31 2026
Summary: Security update for bind
Type: security
Severity: important
References: 1263494,1265591,1265592,1265593,1265594,1265595,1265596,CVE-2026-3039,CVE-2026-3592,CVE-2026-3593,CVE-2026-5946,CVE-2026-5947,CVE-2026-5950
This update for bind fixes the following issues:
Security issues:
- CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
- CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
- CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
- CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
- CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
- CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Non security issue:
- bind test failed with version 9.20.21 (bsc#1263494).
- Upgrade to release 9.20.23
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2749-1
Released: Fri Jul 3 15:04:33 2026
Summary: Security update for perl-DBI
Type: security
Severity: important
References: 1267849,1267957,CVE-2026-10879,CVE-2026-9698
This update for perl-DBI fixes the following issues
- CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (bsc#1267957).
- CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow (bsc#1267849).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2754-1
Released: Fri Jul 3 21:22:01 2026
Summary: Security update for python3-lxml
Type: security
Severity: moderate
References: 1263254,CVE-2026-41066
This update for python3-lxml fixes the following issue
- CVE-2026-41066: information disclosure via untrusted XML input leading to local file read (bsc#1263254).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2759-1
Released: Mon Jul 6 04:04:11 2026
Summary: Security update for apache2
Type: security
Severity: important
References: 1267503,1267955,1267956,1267962,1267963,1267965,1267969,1267970,1267971,1267972,1267976,1267977,1267978,CVE-2026-29167,CVE-2026-29170,CVE-2026-34355,CVE-2026-34356,CVE-2026-42535,CVE-2026-42536,CVE-2026-43951,CVE-2026-44119,CVE-2026-44185,CVE-2026-44186,CVE-2026-44631,CVE-2026-48913,CVE-2026-49975
This update for apache2 fixes the following issues
- CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
- CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
- CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
- CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
- CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
- CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
- CVE-2026-43951: out-of-bound read in `merge_response_headers` can cause crash (bsc#1267963).
- CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
- CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (bsc#1267969).
- CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of
service (bsc#1267970).
- CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
- CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free
(bsc#1267972).
- CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2801-1
Released: Wed Jul 8 21:04:39 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent
Type: security
Severity: important
References: 1268603,1268897,1268898,1268899,1268902,CVE-2026-54512,CVE-2026-54513,CVE-2026-54514,CVE-2026-54515
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- jackson-core: document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
- Update to 2.18.8
* No changes since 2.17.3
Changes for jackson-bom:
- Update to 2.18.8
* Changes
+ #68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x
to help junit5 migration
+ 'base/pom.xml' now creates '${project.version.underscore}' for
'cleansed' version of '${project.version}'
Changes for jackson-core:
- Update to 2.18.8
* Changes of 2.18.8
+ #1611: Apply number-length validator on streaming integer path
of async parser
* Changes of 2.18.7
+ #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
+ #1600: Rework 3rd party licenses in jar
+ #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
* Changes of 2.18.6
+ #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
+ #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
+ #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
* Changes of 2.18.5
+ #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current token is non-numeric
instead of returning null
+ #1446: Invalid package reference to 'java.lang.foreign' from
'com.fasterxml.jackson.core:jackson-core' (from
'FastDoubleParser')
* Changes of 2.18.3
+ #1391: Fix issue where the parser can read back old number
state when parsing later numbers
+ #1397: Jackson changes additional values to infinite in case
of special JSON structures and existing infinite values
+ #1398: Fix issue that feature
COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
characterEscape is used
* Changes of 2.18.2
+ #1359: Non-surrogate characters being incorrectly combined
when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
enabled
* Changes of 2.18.1
+ #1353: Use fastdoubleparser 1.0.90
* Changes of 2.18.
+ #223: 'UTF8JsonGenerator' writes supplementary characters as a
surrogate pair: should use 4-byte encoding
+ #1230: Improve performance of 'float' and 'double' parsing
from 'TextBuffer'
+ #1251: 'InternCache' replace synchronized with 'ReentrantLock'
- the cache size limit is no longer strictly enforced for
performance reasons but we should never go far about the limit
+ #1252: 'ThreadLocalBufferManager' replace synchronized with
'ReentrantLock'
+ #1257: Increase InternCache default max size from 100 to 200
+ #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
+ #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
classes to prevent use by downstream consumers
+ #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
from 3.0)
+ #1274: 'NUL'-corrupted keys, values on JSON serialization
+ #1277: Add back Java 22 optimisation in FastDoubleParser
+ #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
/getDecimalValue()' to avoid String allocation
+ #1305: Make helper methods of 'WriterBasedJsonGenerator'
non-final to allow overriding
+ #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
limit maximum number of Tokens allowed per document#
+ #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
decoding proble
Changes for jackson-databind:
- Update to 2.18.8
* Changes of 2.18.8
+ #5950: Improve 'UUIDeserializer' error handling
+ #5951: Improve 'InetSocketAddress' deserialization
(bsc#1268899, CVE-2026-54514)
+ #5969: '@JsonView' by-passed for some 'setterless' creator
properties
+ #5971: '@JsonView' by-passed for unwrapped creator parameters
+ #5974: '@JsonIgnore' on Record property ignored with
'PropertyNamingStrategy'
+ #5981: 'BasicPolymorphicTypeValidator' setting
'allowIfSubTypeIsArray()' should validate element type
(bsc#1268898, CVE-2026-54513)
+ #5988: 'PolymorphicTypeValidator' needs to validate generic
type parameters too (bsc#1268897, CVE-2026-54512)
+ #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
fold case using JVM default locale (Turkish-I bug)
* Changes of 2.18.4
+ #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
Record property ignored for deserialization
+ #5049: Duplicate creator property 'b' (index 0 vs 1) on simple
java record
* Changes of 2.18.3
+ #4444: The 'KeyDeserializer' specified in the class with
'@JsonDeserialize(keyUsing = ...)' is overwritten by the
'KeyDeserializer' specified in the 'ObjectMapper'.
+ #4827: Subclassed Throwable deserialization fails since
v2.18.0 - no creator index for property 'cause'
+ #4844: Fix wrapped array handling wrt 'null' by
'StdDeserializer'
+ #4848: Avoid type pollution in 'StringCollectionDeserializer'
+ #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not
work with multiple constructors since 2.18
+ #4878: When serializing a Map via
Converter(StdDelegatingSerializer), a NullPointerException is
thrown due to missing key serializer
+ #4908: Deserialization behavior change with @JsonCreator and
@ConstructorProperties between 2.17 and 2.18
+ #4917: 'BigDecimal' deserialization issue when using
'@JsonCreator'
+ #4920: Creator properties are ignored on abstract types when
collecting bean properties, breaking AsExternalTypeDeserializer
+ #4922: Failing '@JsonMerge' with a custom Map
+ #4932: Conversion of 'MissingNode' throws
'JsonProcessingException'
* Changes of 2.18.2
+ #4733: Wrong serialization of Type Ids for certain types of
Enum values
+ #4742: Deserialization with Builder, External type id,
'@JsonCreator' failing
+ #4777: 'StdValueInstantiator.withArgsCreator' is now set for
creators with no arguments
+ #4783 Possibly wrong behavior of @JsonMerge
+ #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'
hides actual error
+ #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides
'@JsonProperty' values
+ #4790: Fix '@JsonAnySetter' issue with 'setter' method
(related to #4639)
+ #4807: Improve 'FactoryBasedEnumDeserializer' to work better
with XML module
+ #4810: Deserialization using '@JsonCreator' with renamed
property failing (since 2.18)
* Changes of 2.18.1
+ #4508: Deserialized JsonAnySetter field in Kotlin data class
is null
+ #4639: @JsonAnySetter on field ignoring unrecognized
properties if they are declared before the last recognized
properties in JSON
+ #4718: Should not fail on trying to serialize
'java.time.DateTimeException'
+ #4724: Deserialization behavior change with Records,
'@JsonCreator' and '@JsonValue' between 2.17 and 2.18
+ #4727: Eclipse having issues due'module-info' class 'lost' on
2.18.0 jars
+ #4741: When 'Include.NON_DEFAULT' setting is used on POJO,
empty values are not included in json if default is 'null'
+ #4749: Fixed a problem with
'StdDelegatingSerializer#serializeWithType' looking up the
serializer with the wrong argument
* Changes of 2.18.0
+ #562: Allow '@JsonAnySetter' to flow through Creators
+ #806: Problem with 'NamingStrategy', creator methods with
implicit names
+ #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and
field level '@JsonProperty'
+ #3120: Return 'ListIterator' from 'ArrayNode.elements()'
+ #3241: 'constructorDetector' seems to invalidate
'defaultSetterInfo' for nullability
+ #3439: Java Record '@JsonAnySetter' value is null after
deserialization
+ #4085: '@JsonView' does not work on class-level for records
+ #4119: Exception when deserialization uses a record with a
constructor property with 'access=READ_ONLY'
+ #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't
work for beans with Creator methods
+ #4407: 'null' type id handling does not work with
'writeTypePrefix()'
+ #4452: '@JsonProperty' not serializing field names properly on
'@JsonCreator' in Record
+ #4453: Allow JSON Integer to deserialize into a single-arg
constructor of parameter type 'double'
+ #4456: Rework locking in 'DeserializerCache'
+ #4458: Rework synchronized block from 'BeanDeserializerBase'
+ #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'
method is not called on the serializer
+ #4472: Rework synchronized block in 'TypeDeserializerBase'
+ #4483: Remove 'final' on method BeanSerializer.serialize()
+ #4515: Rewrite Bean Property Introspection logic in Jackson
2.x
+ #4545: Unexpected deserialization behavior with
'@JsonCreator', '@JsonProperty' and javac '-parameters'
+ #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper
.canSerialize()'
+ #4580: Add 'MapperFeature
.SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator
properties' declaration order for sorting
+ #4584: Provide extension point for detecting 'primary'
Constructor for Kotlin (and similar) data classes
+ #4602: Possible wrong use of _arrayDelegateDeserializer in
BeanDeserializerBase::deserializeFromObjectUsingNonDefault()
+ #4617: Record property serialization order not preserved
+ #4626: '@JsonIgnore' on Record property ignored for
deserialization, if there is getter override
+ #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'
ignored when serializing Records, if there is getter override
+ #4634: '@JsonAnySetter' not working when annotated on both
constructor parameter & field
+ #4678: Java records don't serialize with 'MapperFeature
.REQUIRE_SETTERS_FOR_GETTERS'
+ #4688: Should allow deserializing with no-arg
'@JsonCreator(mode = DELEGATING)'
+ #4694: Deserializing 'BigDecimal' with large number of
decimals result in incorrect value
+ #4699: Add extra 'writeNumber()' method in 'TokenBuffer'
+ #4709: Add 'JacksonCollectors' with 'toArrayNode()'
implementation
+ Fix #5962: Case-insensitive deserialization may use wrong
@JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)
- Fix 'Not fully interpolated version' error with Maven 4
Changes for jackson-dataformats-binary:
- Update to 2.18.8
* Changes of 2.18.8
+ #696: (ion) Incomplete number length validation in Ion decoder
(for 'BigDecimal' and/or 'BigInteger')
* Changes of 2.18.6
+ #645: (avro) Remove use of Avro 'Schema.Parser()
.setValidate()' to allow use of Avro core 1.12.1 (2.x)
+ #649: (cbor, smile) 'StreamReadConstraints.maxDocumentLength'
not checked when creating parser with fixed buffer
+ #651: (smile) Ensure Smile backend supports
'StreamReadConstraints.maxTokenCount'
+ #652: (cbor) Ensure CBOR backend supports
+ Minor fix to 'ProtobufGenerator._reportEnumError()' helper
method
* Changes of 2.18.5
+ #599: (cbor) Unable to deserialize stringref-enabled CBOR with
ignored properties
+ #623: (ion) Upgrade 'ion-java' dep to 1.11.11 (from 1.11.10)
* Changes of 2.18.4
+ #569: (ion) 'IonParser' fails to parse some 'long' values
saying they are out of range when they are not
+ #584: (protobuf) Missing 'JsonToken.END_OBJECT' for nested
Protobuf Objects
+ (ion) Upgrade 'ion-java' to 1.11.10 (from 1.11.9)
* Changes of 2.18.3
+ #541: (cbor, protobuf, smile) 'SmileParser.getValueAsString()'
FIELD_NAME bug
* Changes of 2.18.1
+ #518: Should not read past end for CBOR string values
* Changes of 2.18.0
+ #167: (avro) Incompatibility with Avro >=1.9.0 (upgrade to
Avro 1.11.3)
+ #484: (protobuf) Rework synchronization in 'ProtobufMapper'
+ #494: (avro) Avro Schema generation: allow mapping Java Enum
properties to Avro String values
+ #508: (avro) Ignore 'specificData' field on serialization
+ #509: IonValueMapper.builder() not implemented, does not
register modules
* (ion) Upgrade 'ion-java' to 1.11.9 (from 1.11.8)
value
Changes for jackson-modules-base:
- Upgrade to 2.18.8
* No changes since 2.18.0
* Changes of 2.18.0
+ #233: (jaxb) Tolerate JAX-RS 2.2 in
jackson-module-jaxb-annotations so that it can be deployed in
Liberty alongside features which use 2.2
+ #248: (android-record) jClass annotations and polymorphic
types are ignored when deserializing Android Record fields
+ #251: (android-record) Constructor is not recognized when a
record uses both arrays and generic types
Changes for jackson-parent:
- Update to 2.18.4
* Changes of 2.18.4
+ Update to latest 'oss-parent' (69)
* Changes of 2.18.3
+ Update to latest 'oss-parent' (68)
+ Switch to publishing via Sonatype Central Portal repo
* Changes of 2.18.2
+ Update to latest 'oss-parent' (66); future-proof for Sonatype
Central Portal
* Changes of 2.18.1
+ #15: Add override to downgrade 'moditect-maven-plugin' from
1.2.2 to 1.1.0 to work around Eclipse issues
* Changes of 2.18
+ Update to oss-parent 61 (plugin version updates)
-----------------------------------------------------------------
Advisory ID: SUSE-feature-2026:2806-1
Released: Thu Jul 9 06:08:02 2026
Summary: Feature update for libtcnative-2-0
Type: feature
Severity: moderate
References:
This update for libtcnative-2-0 fixes the following issues:
- New package for the Java stack released as libtcnative-2-0 (jsc#PED-16024)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2828-1
Released: Thu Jul 9 20:30:03 2026
Summary: Security update for python-idna
Type: security
Severity: moderate
References: 1265413,CVE-2026-45409
This update for python-idna fixes the following issue
- CVE-2026-45409: specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2848-1
Released: Fri Jul 10 13:38:57 2026
Summary: Security update for krb5, krb5-mini
Type: security
Severity: important
References: 1263366,1263367,1268131,CVE-2026-11850,CVE-2026-40355,CVE-2026-40356
This update for krb5, krb5-mini fixes the following issues
- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).
- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).
- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2854-1
Released: Fri Jul 10 19:58:37 2026
Summary: Security update for python-urllib3
Type: security
Severity: moderate
References: 1254867,1270365,CVE-2025-66471
This update for python-urllib3 fixes the following issue
- egression introduced by CVE-2025-66471 fix during file download with pySSL (bsc#1270365).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2893-1
Released: Mon Jul 13 13:40:09 2026
Summary: Recommended update for postgresql
Type: recommended
Severity: moderate
References: 1245862
This update for postgresql fixes the following issues:
Changes in postgresql:
- Get rid of update-alternatives and support immutable mode.
See README.SUSE for details. (bsc#1245862, jsc#PED-14820)
- Bump default to 17 for SLE-15-SP7.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2925-1
Released: Mon Jul 13 19:53:23 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1262631,1268402,1268407,1268409,1268413,1268415,1268416,1268417,1268420,1268422,1268427,CVE-2026-10536,CVE-2026-12064,CVE-2026-4873,CVE-2026-8286,CVE-2026-8458,CVE-2026-8924,CVE-2026-8927,CVE-2026-9079,CVE-2026-9080,CVE-2026-9545,CVE-2026-9547
This update for curl fixes the following issues
- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
- CVE-2026-8458: wrong reuse for different services (bsc#1268407).
- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
- CVE-2026-9079: stale proxy password leak (bsc#1268415).
- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
- CVE-2026-9547: SSH improper host validation (bsc#1268420).
- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2950-1
Released: Tue Jul 14 11:24:27 2026
Summary: Security update for perl-HTML-Parser
Type: security
Severity: moderate
References: 1267606,CVE-2026-8829
This update for perl-HTML-Parser fixes the following issue
- CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (bsc#1267606).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2951-1
Released: Tue Jul 14 11:32:32 2026
Summary: Recommended update for dmidecode
Type: recommended
Severity: moderate
References:
This update for dmidecode fixes the following issues:
- Update to upstream version 3.7 (jsc#PED-16217):
* Support for SMBIOS 3.8.0. This includes a new processor family.
* Support for SMBIOS 3.9.0. This includes chassis type name
adjustments, new rack attributes, slot ID for more slot types,
and new memory device form factors and types.
* Decode HPE OEM records 193, 195, 202, 211, 226, 229, 232 and 244.
* Update HPE OEM records 203, 216, 242 and 245.
* EDSFF slot names now include their .S/.L suffix.
- Preserve the use of term 'BIOS' to avoid breaking customer scripts.
- Preserve the use of non-binary units to avoid breaking customer scripts.
- Drop legacy 'Provides:' and 'Obsoletes:' tags.
The split from the pmtools package happened 15 years ago so they are no longer relevant.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2962-1
Released: Tue Jul 14 12:54:51 2026
Summary: Security update for perl-libwww-perl
Type: security
Severity: moderate
References: 1265156,CVE-2026-8368
This update for perl-libwww-perl fixes the following issue
- CVE-2026-8368: LWP: UserAgent: Authorization and Proxy-Authorization headers are leaked on cross-origin redirects
(bsc#1265156).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3026-1
Released: Wed Jul 15 11:49:35 2026
Summary: Security update for python-cryptography
Type: security
Severity: important
References: 1270208,1270515,1270620,1270706,1270772,1270801,1270936,1270994,CVE-2026-41676,CVE-2026-41677,CVE-2026-41678,CVE-2026-41681,CVE-2026-41898,CVE-2026-42327,CVE-2026-44662,CVE-2026-45784
This update for python-cryptography fixes the following issues
- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1
(bsc#1270208).
- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-
openssl crate (bsc#1270620).
- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate
(bsc#1270772).
- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent
memory in rust-openssl crate (bsc#1270801).
- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate
(bsc#1270515).
- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate
(bsc#1270936).
- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-
openssl crate (bsc#1270994).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3041-1
Released: Wed Jul 15 13:48:52 2026
Summary: Security update for sssd
Type: security
Severity: important
References: 1270708,1270709,CVE-2026-14474,CVE-2026-14476
This update for sssd fixes the following issues
- CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege
escalation (bsc#1270709).
- CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass
(bsc#1270708).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3060-1
Released: Wed Jul 15 16:08:22 2026
Summary: Recommended update for cloud-regionsrv-client, python-instance-billing-flavor-check
Type: recommended
Severity: moderate
References: 1247539,1250110,1253777,1254702,1254960,1254982,1254984,1260421,1265930,1267739
This update for cloud-regionsrv-client, python-instance-billing-flavor-check contains the following fixes:
cloud-regionsrv-client:
- Update to version 11.0.3
+ Write instance data cache file after cleaning the cache when
the update server fails. (bsc#1265930)
+ Create the cache directory when populating the cache. (bsc#1267739)
- Update to version 11.0.2:
+ Add iputils as a dependency to make automatic NVIDIA repo enablement
work. (bsc#1260421)
- Update to version 11.0.1:
+ Fix attempt to read a deleted file resulting in an error. Refresh
the file list for repos and services for each pass over the
server domains we are looking to clean up the registration.
+ Update user visible messages only showing messages for the
application configuration file.
- Update to version 11.0.0: (bsc#1254960, bsc#1254982, bsc#1253777)
+ Major version bump for main package and plugin sub-packages due to
interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
+ Create cache directory in code and drop from package (jsc#PED-14732)
+ Fix race condition between license watcher timer and registration
(bsc#1254984)
+ Fix cleanup issue in hosts (bsc#1254702)
+ Fix cache clean up
+ Fix exit condition from container registry setup
+ Lock the registration process to ensure single execution (bsc#1254984)
+ Fix traceback on FP and cert mismatch
+ Switch remaining code to updated logging implementation
+ Increase loggin information in log to help with issue debugging
+ Fix exit code on partial registration success
+ Remove obsolete switchcloudguestservices
- Update to version 10.5.3:
+ Move project setup to poetry and apply python standards
+ Fix use of logging facility
Use logging facility in the desired way throughout the entire
code base. This includes the following changes and refactor
* Add handler and formatter for the logfile containing more
information about function and position in code for the message
* Add handler for stdout (INFO and WARNING)
* Add handler for stderr (ERROR).
* Implement Logger class providing the logging setup and methods
* Drop the start_logging() method.
* Fix and refactor all unit tests around the use of logging
with a proper fixture and place all tests for registerutils
into its own class TestRegisterUtils.
* Add --debug switch for registercloudguest. Allow to increase
logfile information. All messages produced via log.debug(...)
in code will be part of the logfile. Debug messages will not
be shown on the console
* Update SLE12 patches due to logging refactor
* Use --debug flag in guestregister service
python-instance-billing-flavor-check:
- Build fix for SLE 16 and later. (bsc#1250110)
+ Switch SLE 15 SP4 - SP7 to Python 3.11 (jsc#PED-8944)a
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3076-1
Released: Thu Jul 16 15:04:17 2026
Summary: Security update for libssh2_org
Type: security
Severity: moderate
References: 1268530,CVE-2026-55199
This update for libssh2_org fixes the following issue
- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3081-1
Released: Thu Jul 16 17:57:17 2026
Summary: Recommended update for supportutils
Type: recommended
Severity: moderate
References: 1256709,1257383,1258069,1259520
This update for supportutils fixes the following issues:
- Changes to version 3.2.14:
* Integrates supportutils-scrub for data obfuscation, use -j (PED-7324, bsc#1259520)
* Santize env.txt
* ha.txt: Collect hacluster passwd entry
* Added systemd cat unit.service output
* Added softirqs to proc (bsc#1258069)
* Check for /usr/lib/pam.d
* Ignore deprecated crash variable message
* Update supportconfig with note about bpftool
* Added /boot/grub2/grubenv (bsc#1257383)
* Verify procps pkg
- scplugin.rc is restored in package 3.2.12.1 for continued compatibility.
There is no furture development for scplugin.rc. Use supportconfig.rc.
Package version 3.2.12.2 does not have scplugin.rc. (bsc#1256709)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3087-1
Released: Thu Jul 16 19:56:50 2026
Summary: Security update for tomcat11
Type: security
Severity: moderate
References: 1232390,1269791,1269824,1269907,1269908,1269909,1269910,CVE-2026-50229,CVE-2026-53404,CVE-2026-53434,CVE-2026-55276,CVE-2026-55955,CVE-2026-55956
This update for tomcat11 fixes the following issues
Update to Tomcat 11.0.23.
Security issues fixed:
- CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
- CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be
skipped if the first condition in an OR chain matched (bsc#1269910).
- CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
- CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints
to not be included when the effective web.xml was logged (bsc#1269909).
- CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster
component (bsc#1269908).
- CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any
method or method omission configured as part of the constraint (bsc#1269907).
Other updates and bugfixes:
- Upgrade libtcnative to v2 (bsc#1232390).
- Tomcat 11.0.23:
* Catalina
+ Add: Add support for literal '%' characters in access log output. Based on
pull request #1002 by Fabian Hahn. (markt)
+ Fix: Lower the log level to debug when OpenSSL initialization fails in
OpenSSLLifecycleListener to avoid stack traces when libssl.so is not
present and to align the behavior of the isAvailable() check with the
AprLifecycleListener and gracefully fail when natives are not present.
(csutherl)
+ Fix: 70038: Cookie.clone() should also clone the internal attribute map.
(markt)
+ Code: Remove unnecessary code from the SSI processing engine that was
duplicating some of the normalisation checks. (markt)
+ Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
+ Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
(remm)
+ Fix: Incorrect session average life calculation. (remm)
+ Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
(remm)
+ Fix: Avoid any init parameter updates when conflicts are found for
filters, similar to what is done for servlets, as required by the servlet
specification. (remm)
+ Fix: Fix container event cleanups in some edge cases. (remm)
+ Fix: Check for last-modified header in ExpiresFilter when a servlet uses
addDateHeader to avoid wrongly considering it has been set. (remm)
+ Fix: Fix hour unit used by ExpiresFilter. (remm)
+ Fix: Remove exception swallowing in DataSourceStore to align it with
FileStore and avoid session loss on errors. (remm)
+ Fix: Add support for single-quote escaped literal as well as quoted
literals in DateFormatCache. (schultz)
+ Fix: On JAAS logout, clear out role principals on the subject that were
added on commit, as recommended by the JAAS specification. (remm)
+ Fix: MemoryRealm should not add a dummy role when none is specified in the
configuration. (remm)
+ Fix: DataSourceUserDatabase should return a null principal on a non
existing user. (remm)
+ Fix: Fix shared lock expiration in WebDAV. (remm)
+ Fix: Inaccurate session exipration statistics when using the persistent
manager. (remm)
+ Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
+ Fix: Mixup of WrapperListener and WrapperLifecycle elements in
storeconfig. (remm)
+ Fix: Incorrect processing of modified users in DataSourceUserDatabase.
(remm)
+ Update: Clarify behavior in the UserDatabase for user, role and group
creation that it does not immediately override existing elements. Removal
(or update) needs to be used instead. (remm)
+ Fix: 70049: Align the web application class loader with parent class
loaders and swallow any errors caused by invalid paths when looking up
resources and behave as if the resources were not found in that case.
(markt)
+ Fix: Improve validation of Range and Content-Range parsers so invalid
ranges trigger a 4xx response rather than a 500 response. Pull request
#1012 provided by Sahana Surendra Bogar. (markt)
+ Fix: Fix connection leak in ProxyErrorReportValve. (remm)
+ Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off
rather than true or false to align with httpd. (markt)
+ Fix: Reset the encoding used for query string parameters between requests
in case an application changed the encoding in a previous request. (markt)
+ Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce
to URLs that are known not to require it. (markt)
+ Fix: Fix SSO cookie partitioned configuration. (remm)
+ Fix: Fix CombinedRealm isAvailable, it allows authentication if at least
one sub realm is available. (remm)
+ Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
(markt)
+ Fix: Improve the detection of cross-context dispatches when using a
RequestDispatcher. (markt)
+ Fix: Fix various instances of double decoding of URL patterns configured
either programmatically or in web.xml. (remm/markt)
+ Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,
which follows a purely sequential evaluation strategy. (remm)
+ Fix: Update default web.xml version to match supported Servlet
specification version. (markt)
+ Fix: Change the default for the useRedirect attribute of the
ProxyErrorReportValve from true to false. (markt)
+ Add: Add support for the showReport attribute in JsonErrorReportValve and
ProxyErrorReportValve. When set to false, detailed error information
(message, description, stack trace) is suppressed from error responses.
(dsoumis)
+ Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is
removed but catalina-ha.jar is present and the Cluster element is enabled
in server.xml. Cluster digester rules are now fully conditional on both
JARs being available. (dsoumis)
+ Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)
+ Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list
of reserved prefixes for SSI variables and request attributes. (markt)
+ Fix: Missing URL decoding when processing addMapping on a Servlet
registration. (remm)
+ Fix: The Timeout WebDAV header allows comma separated values (according to
the examples in the RFC). Use the first acceptable value. (remm)
+ Fix: Fix various issues when logging the effective web.xml for a web
application. Empty sections are no longer logged. Special roles and empty
authorisation constraints are included. All session cookie attributes are
included. (markt)
+ Fix: Expand the write lock for the save process in the MemoryUserDatabase
to avoid concurrency issues with the file save operations. (markt)
+ Fix: Ensure atomic session persistence in FileStore. Based on pull request
#1016 by sahvx655-wq. (markt)
+ Fix: Do not ignore methods configured on security constraints that map to
the default servlet. (markt)
* Cluster
+ Fix: Expand wording and increase visibility of log message when cloud
membership is configured without a trust store as all certificates will be
trusted in this configuration. (markt)
+ Fix: Ensure listeners are correctly added and removed when configuring the
channel coordinator. (markt)
+ Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)
+ Fix: Fix some concurrency issues in OrderInterceptor. (markt)
+ Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)
+ Fix: Fix concurrency issues generating MD5 digests in the
CloudMembershipProvider implementations. (markt)
+ Add: Add replay protection to the EncryptInterceptor. This us a breaking
change for the EncryptInterceptor.(markt)
* Coyote
+ Add: Log a suitable warning if an encrypted PEM file is detected using an
insecure form for encryption. (markt)
+ Fix: If TLS groups have been configured, use the configured groups rather
than using OpenSSL's default TLS groups when using Tomcat Native with
OpenSSL based connectors. (markt)
+ Fix: For HTTP/2, ensure that any in progress request body reads are
cancelled if the container resets the associated stream. This prevents
delays waiting for reads to time out when it is known that no more data
will be received. (markt)
+ Fix: Ensure that malformed HTTP/2 messages that should trigger a stream
reset do so, rather than triggered a connection close. (markt)
+ Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)
+ Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,
following refactor clean-up of header buffer. (remm)
+ Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)
+ Fix: Fix MessageByte.equals if called on a null MB. (remm)
+ Fix: Call the delegate key manager in JSSE to retrieve the server key.
(remm)
+ Fix: Avoid overflow scenarios in Asn1Parser. (remm)
+ Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that
allows the consistency check for the scheme provided by the user agent to
be bypassed. (markt)
+ Fix: isTrailerFieldsReady was always returning true. (remm)
+ Fix: Align OpenSSL/Panama TLS implementation with other implementations
and throw an exception if there is an error loading the provided CRL(s).
(markt)
+ Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if
@STRENGTH was encountered, ignoring any subsequent expressions. (markt)
+ Fix: Handle the case where the HTTP/2 payload length is insufficient for
the mandatory data required by the flags set in the header. (markt)
+ Fix: 70102: Correct expected size of ticket keys when calling
setSessionTicketKeys with an FFM connector. (markt)
+ Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken
by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)
+ Fix: When processing an OpenSSL cipher specification, fully align the
order of the resulting ciphers with the order produced by OpenSSL. (markt)
+ Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
(schultz)
+ Update: Update both the minimum and recommended version for Tomcat Native
2.x to 2.0.15. (markt)
+ Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
* Jasper
+ Fix: Fix possible EL argument mismatch when it was set to null. (remm)
+ Fix: Fix thread safety of TagPluginManager. (remm)
+ Fix: Correctly use flush on JSP include. (remm)
* Web applications
+ Add: Manager: Add checks to ensure that any uploaded files are uploaded to
the expected location. (markt)
+ Add: Manager: Add checks to ensure that the requested context path for a
deployed WAR, directory or descriptor file is valid. (markt)
+ Add: Documentation: Expand the description of some of the attributes of
the CrawlerSessionManagerValve. (markt)
+ Fix: Documentation: Clearer description and correct documented default for
ocspSoftFail. (markt)
+ Fix: Fix double escaping in the context names for the JSON mode of the
manager servlet. (remm)
+ Fix: Manager: Ensure automatic deployment does not trigger an undeployment
during a Manager triggered web application reload. (markt)
+ Fix: Documentation: Provide better documentation for the scheme and secure
attributes of a Connector. (markt)
* Websocket
+ Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)
+ Fix: Trigger standard WebSocket error handling if a call to
Endpoint.onOpen() fails for a programmatic endpoint. (markt)
+ Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a
programmatic endpoint. Test case provided by uabdur. (markt)
+ Fix: If a client presents invalid parameters when negotiating a WebSocket
extension, decline the negotiation offer that includes the invalid
parameters rather than failing the connection. Pull request #1019 provided
by sahvx655-wq. (markt)
* Other
+ Fix: Use per connection authenticator when executing an Ant task.
(remm/markt)
+ Update: Update Commons Daemon to 1.6.1. (markt)
+ Fix: Prevent duplicate log messages when clustering JARs are not present
on startup. (csutherl)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.12. (markt)
+ Update: Update Tomcat Native to 2.0.15. (markt)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3097-1
Released: Fri Jul 17 13:39:27 2026
Summary: Security update for libxml2
Type: security
Severity: important
References: 1269790,CVE-2026-11979
This update for libxml2 fixes the following issue
- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3100-1
Released: Fri Jul 17 13:41:45 2026
Summary: Security update for python-idna
Type: security
Severity: moderate
References: 1265413,CVE-2026-45409
This update for python-idna fixes the following issue
- CVE-2026-45409: specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3104-1
Released: Fri Jul 17 15:31:14 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1261969,1262098,1262319,1262654,CVE-2026-1502,CVE-2026-4786,CVE-2026-6019,CVE-2026-6100
This update for python311 fixes the following issues
- CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host (bsc#1261969).
- CVE-2026-4786: URLs containing `%action` can bypass mitigation that allows command injection via the
`webbrowser.open()` API (bsc#1262319).
- CVE-2026-6019: HTML parser-sensitive sequence not neutralized by `http.cookies.Morsel.js_output()` (bsc#1262654).
- CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with a `MemoryError` and the
decompression instance is re-used (bsc#1262098).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3106-1
Released: Fri Jul 17 16:02:05 2026
Summary: Recommended update for kmod
Type: recommended
Severity: moderate
References:
This update for kmod fixes the following issues:
- Use in-kernel decompression if available (jsc#PED-16303):
* libkmod:
+ Add a separate function to load the file contents when it's needed.
When it's not needed on the path of loading modules via finit_module(),
there is no need to mmap the file.
+ Extract 2 functions to handle finit_module vs init_modules differences,
with a fallback from the former to the latter.
+ Don't only set the type as direct, but also keep track of the compression being used.
+ When creating the context, read /sys/kernel/compression to check.
what's the compression type supported by the kernel.
+ Use kernel decompression when available
+ add fallback MODULE_INIT_COMPRESSED_FILE define
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3141-1
Released: Tue Jul 21 09:04:39 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1270393
This update for shadow fixes the following issues:
- Fix regression about default GID by setting USERGROUPS_ENAB to no Update (bsc#1270393)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3145-1
Released: Tue Jul 21 10:38:13 2026
Summary: Recommended update for log4j
Type: recommended
Severity: important
References:
This update for log4j fixes the following issues:
log4j was updated and includes fixes and improvements from versions 2.21.0 through 2.26.0:
- Bugs fixed:
- Fixed crashes when logging errors with stack traces modified by other threads
- Fixed FATAL-level log messages being silently discarded
- Fixed memory leaks in several components
- Fixed log file headers not being written correctly when files are recreated
- Fixed log file rotation failures
- Fixed configuration file loading from HTTP sources
- Fixed date and time formatting issues in logs
- Fixed problems when multiple threads modify logger settings simultaneously
- Fixed MongoDB appender connection issues
- New Features Added:
- Support for ZStandard compression for log files
- Support for LMAX Disruptor 4.x (high-performance logging)
- Better support for GraalVM environments
- Java 8 users now get sub-millisecond precision timestamps
- Features Removed:
- JMX GUI tool (moved to separate release)
- Flume Appender (moved to separate release)
- Kubernetes lookup feature (users should migrate to io.fabric8:kubernetes-log4j)
- JAnsi library support (Windows 10+ has built-in color support)
- Important Changes:
- JMX monitoring is now DISABLED by default (set log4j2.disableJmx=false to enable)
- Default log format has changed
- Configuration scripts now require explicit names
- Deprecations (features to be removed in the future):
- MongoDB4 module (use standard MongoDB module instead)
- EventLogger class
- Some builder methods (replaced with setter methods)
New Runtime Dependencies:
- jackson-dataformat-xml
- stax2-api
- woodstox-core
New and Updated Build Dependencies:
- aalto-xml (updated from version 1.3.3 to 1.4.0)
- jakarta-annotations (new)
- jakarta-messaging (new)
- jspecify (new)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3155-1
Released: Tue Jul 21 14:58:48 2026
Summary: Security update for python-tornado6
Type: security
Severity: moderate
References: 1269012
This update for python-tornado6 fixes the following issue
- GHSA-pw6j-qg29-8w7f: `CurlAsyncHTTPClient` leaks per-request credentials on handle reuse (bsc#1269012).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3161-1
Released: Tue Jul 21 16:30:29 2026
Summary: Security update for patch
Type: security
Severity: low
References: 1271166,1271167,CVE-2026-56288,CVE-2026-56289
This update for patch fixes the following issues
- CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence (bsc#1271167).
- CVE-2026-56289: improper validation of hunk line offsets can lead to denial of service (bsc#1271166).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3163-1
Released: Tue Jul 21 16:50:54 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3182-1
Released: Wed Jul 22 09:25:44 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service
(bsc#1262684).
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2026:3190-1
Released: Wed Jul 22 11:24:58 2026
Summary: Optional update for zypp-plugin
Type: optional
Severity: low
References:
This update for zypp-plugin fixes the following issue:
- Add python311-zypp-plugin to Public Cloud Modules. No source change.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3191-1
Released: Wed Jul 22 16:08:30 2026
Summary: Recommended update for adcli
Type: recommended
Severity: moderate
References: 1183870
This update for adcli fixes the following issues:
Update to 0.9.3.1; (jsc#PED-13768);
* enroll: check if AD accepts new password
* enroll: allow to add SPNs to manages service accounts
* enroll: add new SPNs from AD to keytab during update
* conn: use 10s timeout for connect()
* enroll: restore SELinux file context of keytab files
* enroll: remove USE_DES_KEY_ONLY during join
* entry: check user and group names for illegal characters
* tools: add --recursive option to delete-computer
* tools: testjoin, use realm from keytab as domain name
* enroll: use realm form the HOST$ entry in the keytab
* Tests: initial framework and tests for adcli based on
sssd-test-framework
* krb5: add adcli_krb5_get_error_message()
* Various fixes for issues found by static code scanners
* enroll: Populate Samba's secrets database using offline domain
join
Update to 0.9.2:
* adenroll: set password via LDAP instead Kerberos
* disco: fall back to LDAPS if CLDAP ping was not successful
* tools: replace getpass()
* adenroll: write SID before secret to Samba's db
* doc: add clarification to add-member command on doc/adcli.xml
* tools: Set umask before calling mkdtemp()
* Avoid undefined behaviour in short option parsing
* library: include endian.h for le32toh
* man: Fix typos and use consistent upper case for some keywords
* configure: check for ns_get16 and ns_get32 as well
* Add setattr and delattr options
* entry: add passwd-user sub-command
* Add dont-expire-password option
Update to 0.9.1:
* tools: add show-computer command
* add description option to join and update
* Use GSS-SPNEGO if available
* add option use-ldaps
* tools: disable SSSD's locator plugin
* doc: explain required AD permissions
* computer: add create-msa sub-command
* Add account-disable option
* fix coredump in discovery (boo#1183870)
Update to 0.9.0:
* doc: add missing samba_data_tool_path.xml(.in) to EXTRA_DIST
* doc: explain how to force password reset
* Do not use arcfour-hmac-md5 when discovering the salt
* Fix for issue found by Coverity
* adenroll: use only enctypes permitted by Kerberos config
* adenroll: add adcli_enroll_get_permitted_keytab_enctypes with tests
* adconn: add adcli_conn_set_krb5_context
* adenroll: make sure only allowed enctypes are used in FIPS mode
* tools: computer - remove errx from parse_option
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3218-1
Released: Thu Jul 23 19:34:12 2026
Summary: Security update for avahi
Type: security
Severity: moderate
References: 1255451,CVE-2025-59529
This update for avahi fixes the following issue:
- CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTS_MAX (bsc#1255451).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3225-1
Released: Thu Jul 23 20:36:00 2026
Summary: Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni
Type: security
Severity: moderate
References: 1269480,1271727,CVE-2026-26032
This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue
Security issues fixed:
- CVE-2026-26032: improper pathname limitation in `PackagerResolver` allows for arbitrary files writes outside of the
configured `buildRoot` directory (bsc#1271727).
Other updates and bugfixes:
- Update `apache-commons-compress` to 1.28.0.
- Update `apache-ivy` to 2.6.0.
- Include `brotli-java` and update to 1.2.0.
- Include `zstd-jni` and update to v1.5.7.11.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3238-1
Released: Fri Jul 24 14:55:49 2026
Summary: Security update for python-pyasn1
Type: security
Severity: important
References: 1271464,1271465,1271466,CVE-2026-59884,CVE-2026-59885,CVE-2026-59886
This update for python-pyasn1 fixes the following issues:
- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
- CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
(bsc#1271465).
- CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3243-1
Released: Fri Jul 24 15:09:32 2026
Summary: Security update for gpg2
Type: security
Severity: low
References: 1269279,CVE-2026-57062
This update for gpg2 fixes the following issue:
- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3244-1
Released: Fri Jul 24 15:11:25 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1261400,1261982,1261983,1262305,1267644,1267647,CVE-2026-40226
This update for systemd fixes the following issues
Security issues fixed:
- CVE-2026-40226: nspawn: escape-to-host via malformed optional config file (bsc#1261400).
Other updates and bugfixes:
- Fix soft reboot not restarting user services with default.target (bsc#1262305).
- Import commit e46e1952d5 (bsc#1267647 bsc#1262305 bsc#1267644).
- Import commit 429043ca9a (bsc#1261982 bsc#1261983).
- Import commit 58e5d2e21e (bsc#1261982).
- Import commit 4bd91117cc (bsc#1261983).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3269-1
Released: Mon Jul 27 13:00:16 2026
Summary: Security update for gzip
Type: security
Severity: important
References: 1269622,CVE-2026-41991
This update for gzip fixes the following issue:
- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the
user's PATH (bsc#1269622).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3270-1
Released: Mon Jul 27 13:01:22 2026
Summary: Security update for alsa
Type: security
Severity: moderate
References: 1268853,CVE-2026-56109
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory
(bsc#1268853).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3273-1
Released: Mon Jul 27 13:32:13 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
Type: security
Severity: moderate
References: 1268902,1271440,1271442,CVE-2026-54515,CVE-2026-59888,CVE-2026-59889
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of
@JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to
@JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of
@JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-bom:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
* honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
Changes for jackson-dataformats-binary:
- Update to 2.18.9.
Changes for jackson-modules-base:
- Update to 2.18.9.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3330-1
Released: Tue Jul 28 11:35:51 2026
Summary: Security update for libssh
Type: security
Severity: moderate
References: 1272164,1272165,1272166,1272167,1272168,1272169,1272171,CVE-2026-59843,CVE-2026-59844,CVE-2026-59845,CVE-2026-59846,CVE-2026-59847,CVE-2026-59848,CVE-2026-59850
This update for libssh fixes the following issues:
- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).
- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).
- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).
- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).
- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).
- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).
- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3341-1
Released: Tue Jul 28 12:09:19 2026
Summary: Security update for glib2
Type: security
Severity: important
References: 1270008,1270009,1270010,1270016,1270018,1270021,CVE-2026-58010,CVE-2026-58011,CVE-2026-58012,CVE-2026-58013,CVE-2026-58014,CVE-2026-58016
This update for glib2 fixes the following issues:
- CVE-2026-58010: error during gvs_tuple_is_normal alignment validation could cause a 1-byte out-of-bounds read
(bsc#1270009).
- CVE-2026-58011: invalid GDateTime in g_date_time_get_ymd could trigger a 2-byte out-of-bounds read (bsc#1270010).
- CVE-2026-58012: raw byte regex matches with UTF-8 functions during case-change replacements could cause an out-of-
bounds read (bsc#1270016).
- CVE-2026-58013: multi-byte custom line terminator in g_io_channel_read_line_backend could trigger an out-of-bounds
read (bsc#1270018).
- CVE-2026-58014: processing empty key file values in g_key_file_get_locale_string_list could cause a 1-byte out-of-
bounds access (bsc#1270021).
- CVE-2026-58016: malformed D-Bus introspection XML could trigger an unsigned integer overflow (bsc#1270008).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3363-1
Released: Tue Jul 28 14:19:01 2026
Summary: Security update for samba
Type: security
Severity: important
References: 1271469,1271672,1271673,1271674,1271675,1271676,1271677,CVE-2026-15779,CVE-2026-58216,CVE-2026-58218,CVE-2026-58221,CVE-2026-58222,CVE-2026-58224,CVE-2026-6949
This update for samba fixes the following issues
- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation
(bsc#1271469).
- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication
completes (bsc#1271675).
- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes
(bsc#1271677).
- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3381-1
Released: Tue Jul 28 17:35:03 2026
Summary: Recommended update for log4j
Type: recommended
Severity: important
References:
This update for log4j fixes the following issues:
Upgrade to 2.26.1:
* Changed
+ Improve logging for LinkageError scenarios involving the LMAX
Disruptor library
* Fixed
+ Fix the createOnDemand behavior of RollingFileAppender to
correctly defer file and directory creation until the first
log event, while preserving eager creation when disabled
+ Improve documentation for locale handling in the Pattern
Layout date pattern converter
+ Fix handling of non-finite numbers while encoding MapMessage
to JSON
+ Fix encoding of MSGID and SD-ID fields of
StructuredDataMessage to XML
+ Fix stack trace rendering for exceptions with identity
malfunction (e.g., colliding equals() and/or hashCode()
implementations)
+ Fix resource leaks in ConfigurationSource when loading
configuration via URL fails
+ Fix KafkaAppender reporting error to error handler even after
a successful retry
- Generate META-INF/services files using bnd-maven-plugin
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3390-1
Released: Tue Jul 28 17:39:03 2026
Summary: Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn
Type: security
Severity: important
References: CVE-2025-48924
This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues:
apache-commons-lang3 was updated to 3.20.0:
* New features:
+ Add SystemProperties.getPath(String, Supplier<Path>)
+ Add JavaVersion.JAVA_25
+ Add JavaVersion.JAVA_26
+ Add SystemUtils.IS_JAVA_25
+ Add SystemUtils.IS_JAVA_26
+ Add MutablePair.ofNonNull(Map.Entry)
+ Add TimedSemaphore.builder(), Builder, and deprecate
constructors
+ LANG-1504: Adding labels and history to split StopWatch
* Fixed Bugs:
+ Optimize ObjectToStringComparator.compare() method
+ [javadoc] Improve StringUtils Javadoc
+ Fix internal inverted logic in private isEnum() method and
correct its usage in getFirstEnum()
+ Use accessors in ToStringStyle so subclasses can effectively
override them
+ 'LocaleUtils.toLocale(String)' for a 2 letter country code
now returns a value instead of throwing an
'IllegalArgumentException'
+ Fix typo in StringUtils.trunctate() IllegalArgumentException
message and test assertion messages
+ Fix test fixture in
ReflectionDiffBuilderTest.testTransientFieldDifference()
+ LANG-1789: NullPointerException when generating
NoSuchMethodException in MethodUtils
+ LANG-1786: Map deprecated TimeZone short IDs and avoid JRE
WARNINGs to the console
+ LANG-1792: TypeUtils.toString() skips angle brackets for Class
type
+ Mention JDK 25 LTS as a tested version in the release notes
* Changes:
+ Bump org.apache.commons:commons-parent from 88 to 92
Update to 3.19.0:
* New features:
+ Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
+ Add SystemUtils.IS_OS_NETWARE
+ Add MethodUtils.getAccessibleMethod(Class, Method)
+ Add documentation to site for CVE-2025-48924
ClassUtils.getClass(...) can throw a StackOverflowError on
very long inputs
+ Add StringUtils.indexOfAny(CharSequence, int, char...)
+ Add ConcurrentException.ConcurrentException(String)
+ Add DateUtils.toLocalDateTime(Date[, TimeZone])
+ Add DateUtils.toOffsetDateTime(Date[, TimeZone])
+ Add DateUtils.toZonedDateTime(Date[, TimeZone])
+ Add ByteConsumer
+ Add ByteSupplier
+ Add FailableByteConsumer
+ Add FailableByteSupplier
+ LANG-1784: Add Functions methods for null-safe mapping and
chaining
+ LANG-1784: Add Failable methods for null-safe mapping and
chaining
+ Add DoubleRange.fit(double)
+ Add IntegerRange.fit(int)
+ Add LongRange.fit(long)
+ Add DurationUtils.get(String, TemporalUnit, long)
+ Add DurationUtils.getMillis(String, long)
+ Add DurationUtils.getSeconds(String, long)
+ Add SystemProperties.getBoolean(Class, String, boolean)
+ Add SystemProperties.getInt(Class, String, int)
+ Add SystemProperties.getLong(Class, String, long)
* Fixed Bugs:
+ LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the
hierarchy of methods
+ MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now
returns null instead of throwing a NullPointerException, as it
does for other exception types
+ Reduce spurious failures in ArrayUtilsTest methods that test
ArrayUtils.shuffle() methods
+ MethodUtils cannot find or invoke a public method on a public
class implemented in its package-private superclass
+ AtomicSafeInitializer.get() can spin internally if the
FailableSupplier given to AbstractConcurrentInitializer
.AbstractBuilder.setInitializer(FailableSupplier) throws a
RuntimeException
+ LANG-1783: WordUtils.containsAllWords?() may throw
PatternSyntaxException
+ LANG-1782: MethodUtils cannot find or invoke vararg methods
without providing vararg types or values
+ MethodUtils cannot find or invoke vararg methods of interface
types
+ MethodUtils cannot find or invoke vararg methods when widening
primitive types following the JLS 5.1.2. Widening Primitive
Conversion
+ LANG-1597: Invocation fails because matching varargs method
found but then discarded
+ Don't check accessibility twice in MemberUtils
.setAccessibleWorkaround(T)
+ LANG-1774: Improve handling of ClassUtils
.getShortCanonicalName() for invalid input
+ LANG-1720: Improve Javadocs for Conversion
+ Fix CalendarUtils.toLocalDate() Javadoc return type
description
+ Fix the method name in Javadoc examples for CharUtils.isHex()
+ Deprecate NumberUtils.compare(byte, byte) in favor of
Byte.compare(byte, byte)
+ Deprecate NumberUtils.compare(int, int) in favor of
Integer.compare(int, int)
+ Deprecate NumberUtils.compare(long, long) in favor of
Long.compare(long, long)
+ Deprecate NumberUtils.compare(short, short) in favor of
Short.compare(short, short)
+ Deprecate obsolete system property constant
SystemProperties.AWT_TOOLKIT
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_FONTS
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_GRAPHICSENV
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_HEADLESS
+ Deprecate obsolete system property constant
SystemProperties.JAVA_AWT_PRINTERJOB
+ Deprecate obsolete system property constant
SystemProperties.JAVA_COMPILER
+ Deprecate obsolete system property constant
SystemProperties.JAVA_ENDORSED_DIRS
+ Deprecate obsolete system property constant
SystemProperties.JAVA_EXT_DIRS
+ Deprecate method for obsolete system property constant
SystemProperties.getAwtToolkit()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtFonts()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtGraphicsenv()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtHeadless()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaAwtPrinterjob()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaCompiler()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaEndorsedDirs()
+ Deprecate method for obsolete system property constant
SystemProperties.getJavaExtDirs()
+ Deprecate method for obsolete system property constant
SystemUtils.isJavaAwtHeadless()
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_FONTS
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_GRAPHICSENV
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_HEADLESS
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_AWT_PRINTERJOB
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_COMPILER
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_ENDORSED_DIRS
+ Deprecate constants for obsolete system property
SystemUtils.JAVA_EXT_DIRS
+ [javadoc] General improvements
+ [javadoc] Fix thrown exception documentation for
MethodUtils.getMethodObject(Class<?>, String, Class<?>...)
+ [javadoc] Strings::equalsAny: CI doc string should show it's
insensitive
+ [javadoc] General Javadoc improvements
+ LANG-1780: [javadoc] Fix Strings Javadoc
+ [javadoc] Fix typo in Javadoc of Strings instances
+ [javadoc] Fix Javadocs in ClassUtils
+ [javadoc] Fix @deprecated link for StringUtils#startsWithAny
+ Replace old feather logotype with new oak logotype
* Changes:
+ [test] Bump org.apache.commons:commons-text from 1.13.1 to
1.14.0
+ Bump org.apache.commons:commons-parent from 85 to 88
Update to 3.18.0:
- Fix component version in default.properties to 3.12
* Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
* Add FailableShortSupplier, handy for JDBC APIs.
* Add JavaVersion.JAVA_17.
* Add StringUtils.substringBefore(String, int).
* Add Range.INTEGER.
* Add DurationUtils.
* Correct implementation of RandomUtils.nextLong(long, long).
* Update maven-surefire-plugin 2.22.2 -> 3.0.0-M5.
* Bump junit-bom from 5.7.0 to 5.7.1.
* Ignored exception 'ignored', should not be called so.
* Change array style from 'int a[]' to 'int[] a'.
google-guice was updated to fix:
- Fix build with Java 25
- Add alias to com.google.inject:guice::classes artifact, needed
by maven 4.x
maven-resolver-supplier was updated to upstream version 1.9.27:
* Bug Fixes
+ Sync TrackingFileManager with 2.x
Update to upstream version 1.9.26:
* New features and improvements
+ GH-1773: Treat 410 Gone as 404 Not Found
+ GH-1737: Revert partially parallel upload change
* Bug Fixes
+ GH-1768; Drastically simplify auth caching
+ [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF
* Documentation updates
+ Clarify that HTTP Transport uses Apache HTTP Client
* Dependency updates
+ Bump org.redisson:redisson from 3.52.0 to 4.2.0
+ Bump commons-codec:commons-codec from 1.20.0 to 1.21.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.apache.maven:maven-parent from 46 to 47
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.0 to 0.25.4
+ Bump mavenVersion from 3.9.11 to 3.9.12
- Update to upstream version 1.9.25
* New features and improvements
+ Add scope support for trusted checksums
+ Name mappers cleanup and new GAECV mapper
+ Proper metadata locking support
+ Ability to augment metadata nature for version range request
* Bug Fixes
+ TrackingFileManager changes
+ Maven filters daemon friendly
+ Remove hack from Basic connector
+ Fix locking issues
* Documentation updates
+ Updated the documentation to reflect the current list of name
mappers
* Maintenance
+ Mild backport: support same properties as Resolver 2.x
+ Maven resolver lockrepro
+ Bugfix: Java 25 broke test
* Dependency updates
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.23.1 to 0.25.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump commons-codec:commons-codec from 1.18.0 to 1.20.0
+ Bump org.redisson:redisson from 3.50.0 to 3.52.0
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
+ Bump com.google.code.gson:gson from 2.13.1 to 2.13.2
+ Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814
+ Bump mavenVersion from 3.9.10 to 3.9.11
- Update to upstream version 1.9.24
* New features and improvements
+ Metadata type out of coordinates
+ RFC9457 implementation
+ Intern context strings
* Maintenance
+ Align plexus-util version with Maven
+ Align guice version with Maven
+ Enable Github Issues (1.9.x branch)
- Build also maven-resolver-supplier package in separate spec file
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
- Update to upstream version 1.9.23
* Bug
+ MRESOLVER-659: NPE in trusted checksum post processor if
* Improvement
+ MRESOLVER-680: Disable checksum by default for .sigstore.json
as well
+ MRESOLVER-703: HTTP transport should expose config for max
redirects
- Upgrade to upstream version 1.9.22
* Bug
+ MRESOLVER-572: Resolver-Supplier unusable in OSGi runtimes
+ MRESOLVER-574: Invalid Cookie set under proxy conditions
+ MRESOLVER-586: In typical setups, DefaultArtifact copies the
same maps over and over again
+ MRESOLVER-587: Memory consumption improvements
* New Feature
+ MRESOLVER-571: Import o.e.aether packages with the exact same
version in OSGi metadata
* Improvement
+ MRESOLVER-570: Remove excessive strictness of OSGi dependency
metadata
* Task
+ MRESOLVER-576: Allow co-release of Resolver 1.x and 2.x
- Upgrade to upstream version 1.9.20
* Bug
+ MRESOLVER-483: PreorderNodeListGenerator bug: may print
trailing ':'
+ MRESOLVER-522: File locking threads not entering critical
region were 'oversleeping'
+ MRESOLVER-547: BF collector always copies artifacts, even
when it should not
* Improvement
+ MRESOLVER-536: Skip setting last modified time when FS does
not support it
- Add dependency on plexus-xml where relevant
* this will be needed for smooth upgrade to plexus-utils 4.0.0
- Upgrade to upstream version 1.9.18
* Bug
+ MRESOLVER-372: Sporadic AccessDeniedEx on Windows
+ MRESOLVER-441: Undo FileUtils changes that altered non-Windows
execution path
* Improvement
+ MRESOLVER-396: Native transport should retry on HTTP 429
(Retry-After)
* Task
+ MRESOLVER-397: Deprecate Guice modules
+ MRESOLVER-405: Get rid of component name string literals, make
them constants and reusable
+ MRESOLVER-433: Expose configuration for inhibiting
Expect-Continue handshake in 1.x
+ MRESOLVER-435: Refresh download page
+ MRESOLVER-437: Resolver should not override given HTTP
transport default use of expect-continue handshake
- Upgrade to upstream version 1.9.15
* Bug
+ MRESOLVER-373: Remove lock upgrading code
+ MRESOLVER-375: Several key aspects are broken in provided and
trusted checksum feature
+ MRESOLVER-376: StackOverflowError at
BfDependencyCollector.processDependency
+ MRESOLVER-380: Lock diagnostic: attempted lock step is
recorded, but on failed attempt is not removed
+ MRESOLVER-393: Transport HTTP does not retain last modified as
sent by remote end
* Improvement
+ MRESOLVER-220: Modify signaling for unsupported operations
+ MRESOLVER-382: Define local outgoing (bind) address
+ MRESOLVER-385: Reduce default value for
aether.connector.http.connectionMaxTtl
* Task
+ MRESOLVER-378: Update parent POM to 40
+ MRESOLVER-381: Undo MRESOLVER-373 as it was fixed by other
means
+ MRESOLVER-386: Make all injected ctors public, deprecate all
def ctors
+ MRESOLVER-388: Transport HTTP old codec proper override
- Upgrade to upstream version 1.9.12
* Bug
+ [MRESOLVER-371] Unjustified WARNING log added by
MRESOLVER-364
+ [MRESOLVER-361] Unreliable TCP and retries on upload
+ [MRESOLVER-357] ConflictResolver STANDARD verbosity
misbehaves
+ [MRESOLVER-352] Duplicate METADATA_DOWNLOADING event is
being sent
* Improvement
+ [MRESOLVER-360] disable checksum by default for .sigstore
in addition to .asc
* New Feature
+ [MRESOLVER-370] Lock factory should dump lock states on
failure
+ [MRESOLVER-353] Make aether.checksums.algorithms settable
per remote repository
* Task
+ [MRESOLVER-366] Upgrade build plugins
+ [MRESOLVER-364] Revert MRESOLVER-132
+ [MRESOLVER-359] Make build be explicit about build time
requirements
+ [MRESOLVER-356] Remove Guava (is unused)
+ [MRESOLVER-354] Document expected checksums
- Upgrade to upstream version 1.9.8
* Bug
+ [MRESOLVER-345] Conflict resolution in verbose mode is
sensitive to version ordering
+ [MRESOLVER-348] SslConfig httpSecurityMode change is not
detected
+ [MRESOLVER-339] Preemptive Auth broken when default ports used
+ [MRESOLVER-325] [REGRESSION] Suddenly seeing I/O errors under
windows aborting the build
+ [MRESOLVER-330] Static name mapper is unusable with file-lock
factory
+ [MRESOLVER-314] Getting 'IllegalArgumentException: Comparison
method violates its general contract!'
+ [MRESOLVER-316] DF collector enters endless loop when
collecting org.webjars.npm:musquette:1.1.1
+ [MRESOLVER-298] javax.inject should be provided or optional
+ [MRESOLVER-305] Evaluate blocked repositories also when
retrieving metadata
+ [MRESOLVER-309] PrefixesRemoteRepositoryFilterSource aborts
the build while it should not
+ [MRESOLVER-313] Artifact file permissions are 0600 and not
implicitly set by umask
+ [MRESOLVER-296] FileProcessor.write( File, InputStream ) is
defunct
+ [MRESOLVER-292] Documented and used param names mismatch
+ [MRESOLVER-294] Fix JapiCmp configuration and document it
+ [MRESOLVER-285] File locking on Windows knows to misbehave
+ [MRESOLVER-246] m-deploy-p will create hashes for hashes
+ [MRESOLVER-265] Discrepancy between produced and recognized
checksums
+ [MRESOLVER-241] Resolver checksum calculation should be driven
by layout
+ [MRESOLVER-242] When no remote checksums provided by layout,
transfer inevitably fails/warns
+ [MRESOLVER-250] Usage of descriptors map in DataPool prevents
gargabe collection
* New Feature
+ [MRESOLVER-32] Support parallel artifact/metadata uploads
+ [MRESOLVER-319] Support parallel deploy
+ [MRESOLVER-297] Chained LRM
+ [MRESOLVER-167] Support forcing specific repositories for
artifacts
+ [MRESOLVER-268] Apply artifact checksum verification for any
resolved artifact
+ [MRESOLVER-274] Introduce Remote Repository Filter feature
+ [MRESOLVER-275] Introduce trusted checksums source
+ [MRESOLVER-276] Resolver post-processor
+ [MRESOLVER-278] BREAKING: Introduce RepositorySystem shutdown
hooks
+ [MRESOLVER-236] Make it possible to resolve .asc on a 'fail'
respository.
* Improvement
+ [MRESOLVER-346] Too eager locking
+ [MRESOLVER-347] Better connection pool configuration (reuse,
max TTL, maxPerRoute)
+ [MRESOLVER-349] Adapter when locking should 'give up and
retry'
+ [MRESOLVER-350] Get rid of commons-lang dependency
+ [MRESOLVER-327] Make tranport-http obey system properties
regarding proxy settings
+ [MRESOLVER-340] Make WebDAV 'dance' disabled by default
+ [MRESOLVER-341] Add option for preemptive PUT Auth
+ [MRESOLVER-315] Implement preemptive authentication feature
for transport-http
+ [MRESOLVER-328] The transport-http should be able to ignore
cert errors
+ [MRESOLVER-337] Real cause when artifact not found with
repository filtering
+ [MRESOLVER-287] Get rid of deprecated finalize methods
+ [MRESOLVER-317] Improvements for BF collector
+ [MRESOLVER-318] Cleanup redundant code and centralize executor
handling
+ [MRESOLVER-303] Make checksum detection reusable
+ [MRESOLVER-290] Improve file handling resolver wide
+ [MRESOLVER-7] Download dependency POMs in parallel in BF
collector
+ [MRESOLVER-266] Simplify adapter creation and align
configuration for it
+ [MRESOLVER-269] Allow more compact storage of provided
checksums
+ [MRESOLVER-273] Create more compact File locking layout/mapper
+ [MRESOLVER-284] BREAKING: Some Sisu parameters needs to be
bound
+ [MRESOLVER-286] Improve basic connector closed state handling
+ [MRESOLVER-240] Using breadth-first approach to resolve Maven
dependencies
+ [MRESOLVER-247] Avoid unnecessary dependency resolution by a
Skip solution based on BFS
+ [MRESOLVER-248] Make DF and BF collector implementations
coexist
* Task
+ [MRESOLVER-326] Resolver transport-http should retry on
failures
+ [MRESOLVER-331] Make DefaultTrackingFileManager write directly
to tracking files
+ [MRESOLVER-333] Distinguish better resolver errors for
artifact availability
+ [MRESOLVER-320] Investigate slower resolving speeds as
reported by users
+ [MRESOLVER-291] Undo MRESOLVER-284
+ [MRESOLVER-279] Simplify and improve trusted checksum sources
+ [MRESOLVER-281] Update configurations page with new elements
+ [MRESOLVER-282] Drop PartialFile
+ [MRESOLVER-230] Make supported checksum algorithms extensible
+ [MRESOLVER-231] Extend “smart checksum†feature
+ [MRESOLVER-234] Introduce “provided†checksums feature
+ [MRESOLVER-237] Make all checksum mismatches handled same
+ [MRESOLVER-239] Update and sanitize dependencies
+ [MRESOLVER-244] Deprecate FileTransformer API
+ [MRESOLVER-245] Isolate Hazelcast tests
* Dependency upgrade
+ [MRESOLVER-311] Upgrade Parent to 39
+ [MRESOLVER-293] Update dependencies, align with Maven
+ [MRESOLVER-272] Update parent POM to 37, remove plugin version
overrides, update bnd
+ [MRESOLVER-280] Upgrade invoker, install, deploy, require
maven 3.8.4+
+ [MRESOLVER-251] Upgrade Redisson to 3.17.5
+ [MRESOLVER-249] Update Hazelcast to 5.1.1 in
named-locks-hazelcast module
- Add an alias for the wagon connector
- Build against the standalone JavaEE modules unconditionally
- Remove the javax.annotation:javax.annotation-api dependency on
distribution versions that do not incorporate the JavaEE modules
- Add the glassfish-annotation-api jar to the build classpath
- Upgrade to upstream version 1.7.3
* Bug
+ [MRESOLVER-96] - Dependency Injection fails after upgrading
to Maven 3.6.2
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ an
run on Java 8 due to JDK API breakage
+ [MRESOLVER-189] - Using semaphore-redisson followed by
rwlock-redisson on many parallel build of the same project
triggers redisson error
* New Feature
+ [MRESOLVER-90] - HTML content in POM: Maven should validate
content before storing in local repo
+ [MRESOLVER-145] - Introduce more SyncContext implementations
* Improvement
+ [MRESOLVER-103] - Replace deprecated HttpClient classes
+ [MRESOLVER-104] - maven-resolver-demo-maven-plugin uses
reserved artifactId
+ [MRESOLVER-147] - Upgrade to Java 8
+ [MRESOLVER-148] - Use vanilla Guice 4 instead of forked
Guice 3
+ [MRESOLVER-156] - Active dependency management for Google
Guice/Guava
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
+ [MRESOLVER-193] - Properly type lock key names in Redis
+ [MRESOLVER-197] - Minors improvements (umbrella)
+ [MRESOLVER-204] - Add a SessionData#computeIfAbsent method
+ [MRESOLVER-214] - Remove clirr configuration
* Task
+ [MRESOLVER-141] - Review index-based access to collections
+ [MRESOLVER-151] - Enforce a checksum policy to be provided
explicitly
+ [MRESOLVER-152] - Perform null checks when interface
contracts require it
+ [MRESOLVER-154] - Move SyncContextFactory interface to SPI
module
+ [MRESOLVER-155] - Make TrackingFileManager member of
DefaultUpdateCheckManager
+ [MRESOLVER-158] - Simplify SimpleDigest class
+ [MRESOLVER-159] - Mark singleton components as Sisu Singletons
+ [MRESOLVER-160] - Deprecate ServiceLocator
+ [MRESOLVER-162] - Restore binary compatibility broken by
MRESOLVER-154
+ [MRESOLVER-170] - Deprecate org.eclipse.aether.spi.log
+ [MRESOLVER-172] - Make TrackingFileManager shared singleton
component
+ [MRESOLVER-173] - Drop deprecated AetherModule
+ [MRESOLVER-174] - Use all bindings in UTs and tests
+ [MRESOLVER-175] - Drop SyncContextFactory delegates in favor
of a selector approach
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
+ [MRESOLVER-183] - Don't require optional dependencies for
Redisson
+ [MRESOLVER-184] - Destroy Redisson semaphores if not used
anymore
+ [MRESOLVER-186] - Update Maven version in Resolver Demo
Snippets
+ [MRESOLVER-188] - Improve documentation on using the named
locks with redis/hazelcast (umbrella)
+ [MRESOLVER-190] - [Regression] Revert MRESOLVER-184
+ [MRESOLVER-191] - Document how to analyze lock issues
+ [MRESOLVER-196] - Document named locks configuration options
+ [MRESOLVER-219] - Implement NamedLock with advisory file
locking
+ [MRESOLVER-227] - Refactor NamedLockFactorySelector to a
managed component
+ [MRESOLVER-232] - Make SimpleNamedLockFactorySelector logic
reusable
* Sub-task
+ [MRESOLVER-198] - Replace assert by simpler but equivalent
calls
+ [MRESOLVER-199] - Java 8 improvements
+ [MRESOLVER-200] - Simplify conditions with the same result
and avoid extra validations
+ [MRESOLVER-201] - Make variables final whenever possible
+ [MRESOLVER-202] - Use isEmpty() instead length() <= 0
* Dependency upgrade
+ [MRESOLVER-185] - Upgrade Redisson to 3.15.6
* Change of API and incompatible with maven-resolver < 1.7
- Upgrade to upstream version 1.6.3
* Bug
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ and
run on Java 8 due to JDK API breakage
* Improvement
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
* Task
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
* Needed for maven 3.8.4
- Do not build/run the tests against the legacy guava20 package
- Upgrade to upstream version 1.6.2
* Sub-task
+ [MRESOLVER-139] - Make SimpleDigest use SHA-1 or MD5 only
+ [MRESOLVER-140] - Default to SHA-1 and MD5 hashing algorithms
* Bug
+ [MRESOLVER-25] - Resume support is broken under high
concurrency
+ [MRESOLVER-114] - ArtifactNotFoundExceptions when building in
parallel
+ [MRESOLVER-129] - Exclusion has no setters
+ [MRESOLVER-137] - Make OSGi bundles reproducible
+ [MRESOLVER-138] - MRESOLVER-56 introduces severe performance
regression
* New Feature
+ [MRESOLVER-109] - AndDependencySelector should override
toString
+ [MRESOLVER-115] - Make checksum algorithms configurable
+ [MRESOLVER-123] - Provide a global locking sync context by
default
+ [MRESOLVER-131] - Introduce a Redisson-based
SyncContextFactory
+ [MRESOLVER-165] - Add support for mirror selector on
external:http:*
+ [MRESOLVER-166] - Add support for blocked
repositories/mirrors
* Improvement
+ [MRESOLVER-56] - Support SHA-256 and SHA-512 as checksums
+ [MRESOLVER-116] - Add page with all supported configuration
options
+ [MRESOLVER-125] - Use type conversions returning primitives
+ [MRESOLVER-127] - Don't use boolean for property
'aether.updateCheckManager.sessionState'
+ [MRESOLVER-136] - Migrate from maven-bundle-plugin to
bnd-maven-plugin
* Task
+ [MRESOLVER-119] - Turn log messages to SLF4J placeholders
+ [MRESOLVER-130] - Move GlobalSyncContextFactory to a separate
module
+ [MRESOLVER-132] - Remove synchronization in
TrackingFileManager
* Dependency upgrade
+ [MRESOLVER-105] - Update Plexus Components
+ [MRESOLVER-106] - Update HttpComponents
+ [MRESOLVER-107] - Update Wagon Provider API to 3.4.0
+ [MRESOLVER-108] - Update mockito-core to 2.28.2
+ [MRESOLVER-117] - Upgrade SLF4J to 1.7.30
+ [MRESOLVER-118] - Upgrade Sisu Components to 0.3.4
* Needed for maven 3.8.x
- Set buildshell to bash for '<<<'.
- Upgrade to upstream version 1.4.2
* Bug:
+ MRESOLVER-38 – SOE/OOME in DefaultDependencyNode.accept
* Improvements:
+ MRESOLVER-93 – PathRecordingDependencyVisitor to handle 3 cycles
+ MRESOLVER-102 – make build Reproducible
- Upgrade to upstream version 1.4.1
* Task
+ [MRESOLVER-92] - Revert MRESOLVER-7
* Bug
+ [MRESOLVER-86] - ResolveArtifactMojo from resolver example
uses plugin repositories to resolve dependencies
* New Feature
+ [MRESOLVER-10] - New 'TransitiveDependencyManager'
supporting transitive dependency management
+ [MRESOLVER-33] - New 'DefaultDependencyManager' managing
dependencies on all levels supporting transitive dependency
management
* Improvement
+ [MRESOLVER-7] - Download dependency POMs in parallel
+ [MRESOLVER-84] - Add support for 'release' qualifier
+ [MRESOLVER-87] - Refresh examples to use maven-resolver
artifacts for demo
+ [MRESOLVER-88] - Code style cleanup to use Java 7 features
- Initial packaging of maven-resolver 1.3.1
- Generate and customize the ant build files
maven-resolver was update to upstream version 1.9.27:
* Bug Fixes
+ Sync TrackingFileManager with 2.x
- Update to upstream version 1.9.26
* New features and improvements
+ GH-1773: Treat 410 Gone as 404 Not Found
+ GH-1737: Revert partially parallel upload change
* Bug Fixes
+ GH-1768; Drastically simplify auth caching
+ [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF
* Documentation updates
+ Clarify that HTTP Transport uses Apache HTTP Client
* Dependency updates
+ Bump org.redisson:redisson from 3.52.0 to 4.2.0
+ Bump commons-codec:commons-codec from 1.20.0 to 1.21.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.apache.maven:maven-parent from 46 to 47
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.0 to 0.25.4
+ Bump mavenVersion from 3.9.11 to 3.9.12
- Update to upstream version 1.9.25
* New features and improvements
+ Add scope support for trusted checksums
+ Name mappers cleanup and new GAECV mapper
+ Proper metadata locking support
+ Ability to augment metadata nature for version range request
* Bug Fixes
+ TrackingFileManager changes
+ Maven filters daemon friendly
+ Remove hack from Basic connector
+ Fix locking issues
* Documentation updates
+ Updated the documentation to reflect the current list of name
mappers
* Maintenance
+ Mild backport: support same properties as Resolver 2.x
+ Maven resolver lockrepro
+ Bugfix: Java 25 broke test
* Dependency updates
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.23.1 to 0.25.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump commons-codec:commons-codec from 1.18.0 to 1.20.0
+ Bump org.redisson:redisson from 3.50.0 to 3.52.0
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
+ Bump com.google.code.gson:gson from 2.13.1 to 2.13.2
+ Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814
+ Bump mavenVersion from 3.9.10 to 3.9.11
- Update to upstream version 1.9.24
* New features and improvements
+ Metadata type out of coordinates
+ RFC9457 implementation
+ Intern context strings
* Maintenance
+ Align plexus-util version with Maven
+ Align guice version with Maven
+ Enable Github Issues (1.9.x branch)
- Build also maven-resolver-supplier package in separate spec file
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
- Update to upstream version 1.9.23
* Bug
+ MRESOLVER-659: NPE in trusted checksum post processor if
* Improvement
+ MRESOLVER-680: Disable checksum by default for .sigstore.json
as well
+ MRESOLVER-703: HTTP transport should expose config for max
redirects
- Upgrade to upstream version 3.9.16
* Bug Fixes
+ Trim threadConfiguration to accept input surrounded with
spaces
+ Backport: Maven 3.10.x fixed plugin resolution
* Dependency updates
+ Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to
2.11.0
+ [3.9.x] Bump to parent POM 48
+ Bump commons-io:commons-io from 2.21.0 to 2.22.0
+ Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre
+ Bump actions/cache from 5.0.4 to 5.0.5
- There is no need to link the jansi-native library into the tree,
since our jansi java library will load it from the system anyway
- Upgrade to upstream version 3.9.15
* Documentation updates
+ Use new Maven logos in documentation
+ document modelVersion only supported value: 4.0.0
* Dependency updates
+ Bump actions/upload-artifact from 7.0.0 to 7.0.1
+ Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1
+ Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3
+ Bump actions/cache from 5.0.3 to 5.0.4
+ Bump actions/download-artifact from 8.0.0 to 8.0.1
- Upgrade to upstream version 3.9.14
* Bug Fixes
+ plexus-testing dependencies should be used in test scope
* Dependency updates
+ Bump actions/upload-artifact from 6.0.0 to 7.0.0
+ Bump actions/download-artifact from 7.0.0 to 8.0.0
- Upgrade to upstream version 3.9.13
* Bug Fixes
+ Bug: SecDispatcher is managed by legacy Plexus DI
+ [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8
Java version in ranges as well
* Maintenance
+ Update Maven plugin versions in default-bindings.xml
+ Migrate to JUnit 5 - avoid using TestCase
* Dependency updates
+ Maven Resolver 1.9.27
+ Bump resolverVersion from 1.9.25 to 1.9.26
+ Bump version.sisu-maven-plugin from 0.9.0.M4 to 1.0.0
+ Bump actions/cache from 5.0.0 to 5.0.3
+ Bump org.apache.maven:maven-parent from 45 to 47
+ Bump actions/checkout from 6.0.1 to 6.0.2
+ Bump actions/setup-java from 5.1.0 to 5.2.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1
to 3.3.0
+ Bump org.codehaus.plexus:plexus-testing from 2.0.2 to 2.1.0
+ Bump org.ow2.asm:asm from 9.9 to 9.9.1
+ Bump actions/upload-artifact from 5.0.0 to 6.0.0
+ Bump actions/download-artifact from 6.0.0 to 7.0.0
- Specify required maven-resolver version since the
maven-resolver-provider requires methods added in 1.9.25
- Upgrade to upstream version 3.9.12
* New features and improvements
+ Apply resolver changes and improvements
+ Update formatting of prerequisites-requirements error to
improve readability
+ Allow a Maven plugin to require a Java version
+ Use MavenRepositorySystem in ProjectBuildingHelper instead
of deprecated RepositorySystem
+ Make maven.config use UTF8
+ Simplify prefix resolution
* Bug Fixes
+ Add default implementation for new method in
MavenPluginManager
+ Repository layout should be used in MavenRepositorySystem
+ Fix plugin prefix resolution when metadata is not available
from repository
+ Improve source root modification warning message
+ Bug: bad cache isolation between two sessions
+ Set Guice class loading to CHILD - avoid using terminally
deprecated methods
+ Avoid parsing MAVEN_OPTS (3.9.x)
* Documentation updates
+ clarify repository vs deployment repository
+ add maintained branches
* Maintenance
+ Add IntelliJ icon
+ Build by JDK 25
+ Deprecate org.apache.maven.repository.RepositorySystem in
3.9.x
* Build
+ Bump actions/download-artifact from 5.0.0 to 6.0.0
+ Bump actions/upload-artifact from 4.6.2 to 5.0.0
* Dependency updates
+ Bump actions/cache from 4.2.3 to 5.0.0
+ Bump resolverVersion from 1.9.24 to 1.9.25
+ Bump actions/checkout from 5.0.0 to 6.0.1
+ Bump actions/setup-java from 5.0.0 to 5.1.0
+ Bump commons-cli:commons-cli from 1.9.0 to 1.11.0
+ Bump org.codehaus.plexus:plexus-interpolation from 1.28 to
1.29
+ Bump commons-io:commons-io from 2.19.0 to 2.21.0
+ Bump xmlunitVersion from 2.10.3 to 2.11.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump org.ow2.asm:asm from 9.8 to 9.9
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
- Upgrade to upstream version 3.9.11
* New features and improvements
+ Augment version range resolution used repositories
* Bug Fixes
+ Deduplicate filtered dependency graph
+ Move ensure in boundaries of project lock
* Maintenance
+ [MNGSITE-393] - remove references to Maven 2
+ Update CONTRIBUTING after GitHub issues enabled
+ Enable Github Issues
+ [MNG-8763] - Remove name from site bannerLeft
* Build
+ Pin GitHub action versions by hash
+ Build the project by JDK 21 as default
+ Use Maven 3.9.10 for build on GitHub
- Upgrade to upstream version 3.9.10
* Bug
+ MNG-8096: Inconsistent dependency resolution behaviour for
concurrent multi-module build can cause failures
+ MNG-8169: MINGW support requires
--add-opens java.base/java.lang=ALL-UNNAMED
+ MNG-8170: Maven 3.9.8 contains weird native library for Jansi
on Windows/arm64
+ MNG-8211: Maven should fail builds that use CI Friendly
versions but have no values set
+ MNG-8248: WARNING: A restricted method in java.lang.System has
been called
+ MNG-8256: ProjectDependencyGraph bug: in case of filtering,
non-direct module links are lost
+ MNG-8315: Failure of mvn.cmd if a .mvn directory is located at
drive root
+ MNG-8396: Maven takes forever to resume
+ MNG-8711: 'Duplicate artifact' in LifecycleDependencyResolver
* Improvement
+ MNG-8370: Introduce maven.repo.local.head
+ MNG-8399: JDK 24+ issues warning about usage of
sun.misc.Unsafe
+ MNG-8707: Add methods to remove compile and test source roots
+ MNG-8712: improve dependency version explanation: it's a
requirement, not always effective version
+ MNG-8717: Remove maven-plugin-plugin:addPluginArtifactMetadata
from default binding
+ MNG-8722: Use a single standalone version of asm
+ MNG-8731: Use https for xsi:schemaLocation in generated
descriptors
+ MNG-8734: Simplify scripting like 'get project version' cases
* Task
+ MNG-8728: Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 and use
Java 24 on CI
- Link also the objectweb-asm/asm to the lib directory
+ MNG-8177: Warning
xmvn-connector was updated to fix:
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn-mojo was updated to fix:
Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn-parent was updated to fix:
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn-tools was updated to:
- The new commons-compress needs commons-lang3
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
xmvn was updated to fix:
- Adapt to no libjansi.so linked into the arch independent path
- Fix build after removal of the default %%{java_home} define
- Upgrade to version 4.3.0
* Changes:
+ Fix typo in JavadocMojo
+ Reproducible javadoc
+ Reproducible manifest injection
+ Deprecate UUIDs
+ Implement MetadataResult.getPackageMetadataMap()
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3397-1
Released: Tue Jul 28 20:31:23 2026
Summary: Security update for python-urllib3
Type: security
Severity: moderate
References: 1268683,CVE-2026-9375
This update for python-urllib3 fixes the following issue
- CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of
service (bsc#1268683).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3401-1
Released: Wed Jul 29 12:39:03 2026
Summary: Security update for sssd
Type: security
Severity: moderate
References: 1269807,CVE-2026-12610
This update for sssd fixes the following issue:
- CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a
use-after-free (bsc#1269807).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3406-1
Released: Wed Jul 29 13:09:09 2026
Summary: Security update for java-17-openjdk
Type: security
Severity: important
References: 1264396,1264994,1267355,1272223,1272224,1272225,1272227,1272228,1272235,1272236,1272237,CVE-2026-41254,CVE-2026-46917,CVE-2026-46968,CVE-2026-47010,CVE-2026-47021,CVE-2026-47027,CVE-2026-47059,CVE-2026-47063,CVE-2026-60147
This update for java-17-openjdk fixes the following issues:
Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU).
Security issues fixed:
- CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in `CubeSize` (bsc#1264994).
- CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1272223).
- CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or
modification access to critical data(bsc#1272224).
- CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert or delete access to some data (bsc#1272225).
- CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272227).
- CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272228).
- CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272235).
- CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,
deletion or modification access to critical data (bsc#1272236).
- CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert, delete and read access to some(bsc#1272237).
Other updates and bugfixes:
- Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
- Make post scripts less noisy (bsc#1267355).
- Use libalternatives instead of update-alternatives for distributions where libalternatives is available.
- Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU):
+ JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+ JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
+ JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails
+ JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel
+ JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F
+ JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/
/PrintDialogsTest.java instruction need to update
+ JDK-8183336: Better cleanup for jdk/test/java/lang/module/
/customfs/ModulesInCustomFileSystem.java
+ JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+ JDK-8240908: RetransformClass does not know about
MethodParameters attribute
+ JDK-8255463: java/nio/channels/spi/SelectorProvider/
/inheritedChannel/InheritedChannelTest.java failed with
ThreadTimeoutException
+ JDK-8272477: Additional cleanup of test/jdk/java/nio/file/spi/
/SetDefaultProvider.java
+ JDK-8274082: Wrong test name in jtreg run tag for java/awt/
/print/PrinterJob/SwingUIText.java
+ JDK-8277444: Data race between
JvmtiClassFileReconstituter::copy_bytecodes and class linking
+ JDK-8281243: Test java/lang/instrument/
/RetransformWithMethodParametersTest.java is failing
+ JDK-8282044: [JVMCI] Export _sha3_implCompress,
_md5_implCompress and aarch64::_has_negatives stubs to JVMCI
compiler.
+ JDK-8284993: Replace System.exit call in swing tests with
RuntimeException
+ JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads
the spinner value wrong and sometime partially
+ JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/
/nativeAndMH/Test.java fails with Out of space in CodeCache
+ JDK-8287062: com/sun/jndi/ldap/LdapPoolTimeoutTest.java failed
due to different timeout message
+ JDK-8290504: Close streams returned by ModuleReader::list
+ JDK-8293484: AArch64:
TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU
with SHA512 feature support
+ JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages
+ JDK-8298783: java/lang/ref/FinalizerHistogramTest.java failed
with 'RuntimeException: MyObject is not found in test output'
+ JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with 'No MouseReleased
event on label!'
+ JDK-8299304: Test 'java/awt/print/PrinterJob/
/PageDialogTest.java' fails on macOS 13 x64 because the Page
Dialog blocks the Toolkit
+ JDK-8304065: HttpServer.stop should terminate immediately if
no exchanges are in progress
+ JDK-8309142: Refactor test/langtools/tools/javac/versions/
/Versions.java
+ JDK-8316274: javax/swing/ButtonGroup/
/TestButtonGroupFocusTraversal.java fails in Ubuntu 23.10 with
Motif LAF
+ JDK-8317801: java/net/Socket/asyncClose/Race.java fails
intermittently (aix)
+ JDK-8320677: Printer tests use invalid '@run main/manual=yesno
+ JDK-8321182: SourceExample.SOURCE_14 comment should refer to
'switch expressions' instead of 'text blocks'
+ JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+ JDK-8323089: networkaddress.cache.ttl is not a system property
+ JDK-8323545: java/awt/GraphicsDevice/CheckDisplayModes.java
fails with 'exit code: 133'
+ JDK-8323672: Suppress unwanted autoconf added flags in CC and
CXX
+ JDK-8324345: Stack overflow during C2 compilation when
splitting memory phi
+ JDK-8324641: [IR Framework] Add Setup method to provide custom
arguments and set fields
+ JDK-8328300: Convert PrintDialogsTest.java from Applet to main
program
+ JDK-8332495: java/util/logging/LoggingDeadlock2.java fails
with AssertionError: Some tests failed
+ JDK-8334928: Test sun/security/ssl/SSLSocketImpl/
/ReuseAddr.java failed: java.net.BindException: Address
already in use
+ JDK-8337876: [IR Framework] Add support for IR tests with
@Stable
+ JDK-8338103: Stabilize and open source a Swing OGL
ButtonResizeTest
+ JDK-8338112: Test testlibrary_tests/ir_framework/tests/
/TestPrivilegedMode.java fails with release build
+ JDK-8338344: Test TestPrivilegedMode.java intermittent fails
java.lang.NoClassDefFoundError: jdk/test/lib/Platform
+ JDK-8338554: Fix inconsistencies in javadoc/doclet/
/testLinkOption/TestRedirectLinks.java
+ JDK-8338883: Show warning when CreateCoredumpOnCrash set, but
core dump will not happen
+ JDK-8339233: Test javax/swing/JButton/
/SwingButtonResizeTestWithOpenGL.java#id failed: Button
renderings are different after window resize
+ JDK-8339238: Update to use jtreg 7.5.1
+ JDK-8339879: Open some dialog awt tests
+ JDK-8339975: Open some dialog awt tests 2
+ JDK-8340140: Open some dialog awt tests 3
+ JDK-8340336: Open some checkbox awt tests
+ JDK-8340494: Open some dialog awt tests 4
+ JDK-8340851: Open some TextArea awt tests
+ JDK-8340987: Open some TextArea awt tests 1
+ JDK-8341055: Open some TextArea awt tests 2
+ JDK-8341292: Open some TextArea awt tests 3
+ JDK-8341376: Open some TextArea awt tests 4
+ JDK-8341427: JFR: Adjust object sampler span handling
+ JDK-8342401: [TESTBUG] javax/swing/JSpinner/8223788/
/JSpinnerButtonFocusTest.java test fails in ubuntu 22.04 on
SBR Hosts
+ JDK-8345618: javax/swing/text/Caret/8163124/
/CaretFloatingPointAPITest.java leaves Caret is not complete
+ JDK-8346154: [XWayland] Some tests fail intermittently in the
CI, but not locally
+ JDK-8347811: Container detection code for cgroups v2 should
use cgroup.controllers
+ JDK-8347836: Disabled PopupMenu shows shortcuts on Mac
+ JDK-8349192: jvmti/scenarios/contention/TC05/tc05t001 fails:
ERROR: tc05t001.cpp, 281: (waitedThreadCpuTime -
waitThreadCpuTime) < (EXPECTED_ACCURACY * 1000000)
+ JDK-8349533: Refactor validator tests shell files to java
+ JDK-8349988: Change cgroup version detection logic to not
depend on /proc/cgroups
+ JDK-8350749: Upgrade JLine to 3.29.0
+ JDK-8352685: Opensource JInternalFrame tests - series2
+ JDK-8352733: Improve RotFontBoundsTest test
+ JDK-8352877: Opensource Several Font related tests - Batch 1
+ JDK-8353488: Open some JComboBox bugs 3
+ JDK-8353552: Opensource Several Font related tests - Batch 3
+ JDK-8354163: Open source Swing tests Batch 1
+ JDK-8354469: Keytool exposes the password in plain text when
command is piped using | grep
+ JDK-8354695: Open source several swing tests batch7
+ JDK-8354878: File Leak in
CgroupSubsystemFactory::determine_type of
cgroupSubsystem_linux.cpp:300
+ JDK-8354900: javax/swing/AbstractButton/bug4133768.java
failing on macosx-aarch64
+ JDK-8355048: ProblemList TestGlyphVectorLayout.java on all
platforms
+ JDK-8355179: Reinstate javax/swing/JScrollBar/4865918/
/bug4865918.java headful and macos run
+ JDK-8355332: Fix failing semi-manual test EDT issue
+ JDK-8355443: [java.io] Use @requires tag instead of exiting
based on File.separatorChar value
+ JDK-8355445: [java.nio] Use @requires tag instead of exiting
based on 'os.name' property value
+ JDK-8356107: [java.lang] Use @requires tag instead of exiting
based on os.name or separatorChar property
+ JDK-8357062: Update Public Suffix List to 823beb1
+ JDK-8357082: Stabilize and add debug logs to CopyAreaOOB.java
+ JDK-8357141: Update to use jtreg 7.5.2
+ JDK-8357280: (bf) Remove @requires tags from java/nio/Buffer/
/LimitDirectMemory[NegativeTest].java
+ JDK-8357390: java/awt/Toolkit/ScreenInsetsTest/
/ScreenInsetsTest.java Test failing on Ubuntu 24.04 Vm Hosts
used by Oracle's internal CI system
+ JDK-8358058: sun/java2d/OpenGL/DrawImageBg.java Test fails
intermittently
+ JDK-8358751: C2: Recursive inlining check for compiled lambda
forms is broken
+ JDK-8359978: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java
failed again with java.net.SocketException: An established
connection was aborted by the software in your host machine
+ JDK-8360160: ubuntu-22-04 machine is failing client tests
+ JDK-8360882: Tests throw SkippedException when they should
fail
+ JDK-8361106: [TEST] com/sun/net/httpserver/Test9.java fails
with java.nio.file.FileSystemException
+ JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a
+ JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25
+ JDK-8364190: JFR: RemoteRecordingStream withers don't work
+ JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles
+ JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java
+ JDK-8365379: SU3.applyInsets may produce wrong results
+ JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26
+ JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26
+ JDK-8365526: Crash with null Symbol passed to
SystemDictionary::resolve_or_null
+ JDK-8365625: Can't change accelerator colors in Windows L&F
+ JDK-8366128: jdk/jdk/nio/zipfs/TestPosix.java::testJarFile
uses wrong file
+ JDK-8366261: Provide utility methods for
sun.security.util.Password
+ JDK-8366369: Add @requires linux for GTK L&F tests
+ JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing
+ JDK-8367583: sun/security/util/AlgorithmConstraints/
/InvalidCryptoDisabledAlgos.java fails after JDK-8244336
+ JDK-8367772: Refactor createUI in PassFailJFrame
+ JDK-8367784: java/awt/Focus/InitialFocusTest/
/InitialFocusTest1.java failed with Wrong focus owner
+ JDK-8368041: Enhance TLS certificate handling
+ JDK-8368335: Refactor the rest of Locale TestNG based tests to
JUnit
+ JDK-8368498: Use JUnit instead of TestNG for jdk_text tests
+ JDK-8368551: Core dump warning may be confusing
+ JDK-8368670: Deadlock in JFR on event register + class load
+ JDK-8368683: [process] Increase jtreg debug output
maxOutputSize for TreeTest
+ JDK-8368754: runtime/cds/appcds/SignedJar.java log regex is
too strict
+ JDK-8368885: NMT CommandLine tests can check for error better
+ JDK-8368892: Make JEditorPane/TestBrowserBGColor.java headless
+ JDK-8369251: Opensource few tests
+ JDK-8369319: java/net/httpclient/CancelRequestTest.java fails
intermittently
+ JDK-8369335: Two sun/java2d/OpenGL tests fail on Windows
after JDK-8358058
+ JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)
+ JDK-8369851: Remove darcy author tags from langtools tests
+ JDK-8369858: Remove darcy author tags from jdk tests
+ JDK-8369911: Test sun/java2d/marlin/ClipShapeTest.java
#CubicDoDash, #Cubic and #Poly fail intermittent
+ JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException
+ JDK-8370325: G1: Disallow GC for TLAB allocation
+ JDK-8370511: test/jdk/javax/swing/JSlider/bug4382876.java does
not release previously pressed keys
+ JDK-8370732: Use WhiteBox.getWhiteBox().fullGC() to provoking
gc for nsk/jvmti tests
+ JDK-8370942: test/jdk/java/security/Provider/NewInstance.java
and /test/jdk/java/security/cert/CertStore/NoLDAP.java may
skip without notifying
+ JDK-8371365: Update javax/swing/JFileChooser/bug4759934.java
to use Util.findComponent()
+ JDK-8371366: java/net/httpclient/whitebox/
/RawChannelTestDriver.java fails intermittently in jtreg
timeout
+ JDK-8371383: Test sun/security/tools/jarsigner/
/DefaultOptions.java failed due to
CertificateNotYetValidException
+ JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests
+ JDK-8372120: Add missing sound keyword to MIDI tests
+ JDK-8372351: Add 2 WISeKey roots
+ JDK-8372609: Bug4944439 does not enforce locale correctly
+ JDK-8372661: Add a null-safe static factory method to
'jdk.test.lib.net.SimpleSSLContext'
+ JDK-8372988: Test runtime/Nestmates/membership/
/TestNestHostErrorWithMultiThread.java failed: Unexpected
interrupt
+ JDK-8373101: JdkClient and JdkServer test classes ignore
namedGroups field
+ JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages
+ JDK-8373275: Improve DTLS handshaking
+ JDK-8373623: Refactor Serialization tests for Records to JUnit
+ JDK-8373650: Test 'javax/swing/JMenuItem/6458123/
/ManualBug6458123.java' fails because the check icons are not
aligned properly as expected
+ JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms
+ JDK-8373716: Refactor further java/util tests from TestNG to
JUnit
+ JDK-8373807: test/jdk/java/net/httpclient/websocket/
/DummyWebSocketServer.java getURI() uses 'localhost'
+ JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the “Nothing†menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test
+ JDK-8373869: Refactor java/net/httpclient/
/ThrowingPushPromises*.java tests to use JUnit5
+ JDK-8373928: 4 Dangling pointer defect groups in java.c
+ JDK-8373931: Test javax/sound/sampled/Clip/
/AutoCloseTimeCheck.java timed out
+ JDK-8374058: Enhance JPEG handling
+ JDK-8374178: Missing include in systemDictionary.cpp after
JDK-8365526
+ JDK-8374304: MultiResolutionSplashTest.java fails in CI:
'Image with wrong resolution is used for splash screen!'
+ JDK-8374433: java/util/Locale/PreserveTagCase.java does not
run any tests
+ JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F
+ JDK-8374548: Process httpserver cancelled keys more quickly
+ JDK-8374555: No need for visible input warning in
s.s.u.Password when not reading from System.in
+ JDK-8374711: Hotspot runtime/CommandLine/OptionsValidation/
/TestOptionsWithRanges fails without printing the option name
+ JDK-8374888: Implement internal test cache to help
UserIterCount test performance
+ JDK-8374998: Failing os::write - remove bad file
+ JDK-8375065: Update LCMS to 2.18
+ JDK-8375080: The tools/jpackage/windows/Win8365790Test.java
may fail with ClassNotFoundException: jtreg.SkippedException
+ JDK-8375231: Refactor util/ServiceLoader tests to use JUnit
+ JDK-8375232: Refactor util/StringJoiner tests to use JUnit
+ JDK-8375233: Refactor util/Vector tests to use JUnit
+ JDK-8375999: com/sun/jndi/ldap/LdapPoolTimeoutTest.java fails
sporadically on Windows
+ JDK-8376031: HttpsURLConnection.getServerCertificates() throws
'java.lang.IllegalStateException: connection not yet open' for
the HEAD method
+ JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed
+ JDK-8376233: Clean up code in Desktop native peer
+ JDK-8377158: Enhance XBM image support
+ JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable
+ JDK-8377498: Improve HttpServer handling
+ JDK-8377602: Create automated test for PageRange
+ JDK-8377678: G1: Heap Dumping crashes with -UseClassUnloading
+ JDK-8377727: Ghost caret and focus appear in non‑editable text
fields
+ JDK-8377833: Enhance Jar file processing
+ JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java
+ JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace
+ JDK-8378113: Add sun/java2d/OpenGL/ScaleParamsOOB.java to the
ProblemList.txt file
+ JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable
+ JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob
+ JDK-8378687: Improve delegation of HttpURLConnection
+ JDK-8378777: Bump update version for OpenJDK: jdk-17.0.20
+ JDK-8378802: [21u] backport changes to TKit.java by
JDK-8352419
+ JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument
+ JDK-8380565: PPC64: deoptimization stub should save vector
registers
+ JDK-8380672: Improve certification checking
+ JDK-8380947: Add pull request template
+ JDK-8381039: Enhance AWT ImagingLib
+ JDK-8381049: Enhance Jar handling
+ JDK-8381205: GHA: Upgrade Node.js 20 to 24
+ JDK-8381519: Enhance Der Value Handling
+ JDK-8381796: Enhance Certificate parsing
+ JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String
+ JDK-8383175: (tz) Update Timezone Data to 2026b
+ JDK-8383354: Update LCMS to 2.19.1
+ JDK-8383473: Follow on from tzdata2026b time change to include
temporary hack BC time change
+ JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
'weak' on 'phantom' path
+ JDK-8383630: Fix iteration in tests doing class redefinition
+ JDK-8383659: [17u] JVM crashes during stub routines generation
on Windows and rare combination of CPU features
+ JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily
+ JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025
+ JDK-8384495: Update Libpng to 1.6.58
+ JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates
+ JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate
+ JDK-8384902: Update GIFlib to 6.1.3
+ JDK-8385390: Update FreeType to 2.14.3
+ JDK-8385490: Update HarfBuzz to 14.2.0
+ JDK-8386343: [17u] Fix NTLMHeadTest after backport of 8384486
+ JDK-8386551: Windows build broken because of MSys2/Make update
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3415-1
Released: Thu Jul 30 08:54:36 2026
Summary: Security update for perl-DBI
Type: security
Severity: important
References: 1271017,1271018,1271399,1271458,1271459,1271629,CVE-2026-14380,CVE-2026-14740,CVE-2026-15043,CVE-2026-15392,CVE-2026-60081,CVE-2026-60082
This update for perl-DBI fixes the following issues
- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code
execution (bsc#1271018).
- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash
(bsc#1271017).
- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters
(bsc#1271399).
- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`
allows for arbitrary file reads and writes (bsc#1271629).
- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file
memory-amplification DoS (bsc#1271458).
- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row
can lead to a process crash (bsc#1271459).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3424-1
Released: Thu Jul 30 13:07:33 2026
Summary: Security update for python3-pyOpenSSL
Type: security
Severity: low
References: 1259804,CVE-2026-27448
This update for python3-pyOpenSSL fixes the following issue:
- CVE-2026-27448: unhandled exception in `set_tlsext_servername_callback` callback can result in connection not being
cancelled and allows for possible security measure bypassing (bsc#1259804).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3426-1
Released: Thu Jul 30 13:12:03 2026
Summary: Security update for bind
Type: security
Severity: important
References: 1271982,1271983,1271984,1271985,1271986,1271987,1271988,1271989,1271990,CVE-2026-10723,CVE-2026-10822,CVE-2026-11331,CVE-2026-11605,CVE-2026-11622,CVE-2026-11721,CVE-2026-12617,CVE-2026-13204,CVE-2026-13321
This update for bind fixes the following issues:
Upgrade to release 9.20.26.
Security issues fixed:
- CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
- CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
- CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
- CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
- CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
- CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
- CVE-2026-12617: record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
- CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
- CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).
Other updates and bugfixes:
- Release 9.20.26:
* Reclaim memory promptly when DNSSEC validations are canceled.
* Removed Features:
* Remove the secondary validator in query.c.
* Remove ineffective TCP fallback after repeated UDP timeouts.
* Feature Changes:
* Fall back to TCP on receipt of a UDP response with a mismatched
query ID.
* Limit the number of glue records cached from a referral.
* Fix a resolver stall on a CNAME response to a DS query.
* Bug Fixes:
* Fix a bug in DNS UPDATE processing with inline-signing enabled.
* Properly detect private records before copying.
* Tighten referral DS acceptance.
* Don't synthesize negative responses with pending NSEC.
* Check that an NSEC signer is at or above the name to be
validated.
* Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
* Fix a deny-answer-aliases configuration bypass issue.
* Reject external referrals from forwarders.
* Fix a zone transfer over TLS (XoT) issue when using the
opportunistic TLS mode.
* Unvalidated opt-out NSEC3 could be accepted in insecurity
proof.
* Check wildcard signer and NOQNAME signer match.
* Fix CNAME resolution failure caused by a cached SERVFAIL
response.
* Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
* Fix a bug in GeoIP2 string matching.
* Fix DNS-over-HTTPS (DoH) quota configuration issue.
* Truncated reply to a TSIG query no longer stalls the resolver.
* Ignore updates removing DNSKEY RRset with class ANY.
* Ignore 0-byte reads in the TCP read callback.
* Only print per-zone glue stats when zone-statistics is set to
full.
* CDS/CDNSKEY records were not removed when re-configuring the
server.
* Fix a crash when querying an empty non-terminal in a wildcard
zone in RBTDB.
* Stop reusing outgoing TCP connections the peer has already
closed.
* Fix DNSSEC validation failures for names under an apex DNAME.
* The resolver now removes other RRsets at the same name when
caching a CNAME.
* Fix nxdomain-redirect combined with dns64.
* Fix DNS64 owner case after DNAME restart.
* Clear REDIRECT flag when it isn't needed.
* Disable output escaping in bind9.xsl.
* Fix crash on badly configured secondary signer.
* Fix a possible crash on concurrent TKEY DELETE for the same
key.
* Reject RRSIG records covering meta-types.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3429-1
Released: Thu Jul 30 13:18:04 2026
Summary: Security update for libarchive
Type: security
Severity: moderate
References: 1254340,1254341,1260998,1261002,1261003
This update for libarchive fixes the following issues:
- creating temporary files in the current working directory instead of the target directory can lead to file creation
failures when the working directory is not writable (bsc#1254340).
- file descriptor leak in the mtree parser cleanup path could lead to file descriptor exhaustion and denial of service
(bsc#1261003).
- NULL pointer dereference in archive_acl_from_text_w() could lead to a segmentation fault (bsc#1260998).
- reading from an invalid index when buffer size is smaller than H_LEVEL_OFFSET can lead to an out-of-bounds buffer
overrun (bsc#1254341).
- incorrect pointer handling for RAR5 files declaring over 8192 filters can lead to excessive resource usage and denial
of service (bsc#1261002).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3430-1
Released: Thu Jul 30 13:20:38 2026
Summary: Security update for tomcat11
Type: security
Severity: important
References: 1271397,1271398,CVE-2026-59083,CVE-2026-59084
This update for tomcat11 fixes the following issues:
Update to Tomcat 11.0.24.
Security issues fixed:
- CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass (bsc#1271397).
- CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).
Other updates and bugfixes:
- Tomcat 11.0.24:
* Catalina
+ Fix: Avoid a race condition with concurrent lookups for a singleton JNDI
resource. (markt)
+ Fix: Improve the performance of range validation for the default
servlet. (markt)
+ Fix: Avoid NPE in RewriteValve. (markt)
+ Fix: 70127: Fix use of Bootstrap through reflection by restoring the
public constructor. Use through scripts was not affected. (remm)
+ Fix: Restore ability to extend many element classes from
AbstractAccessLogValve. (remm)
+ Fix: Align DIGEST authentication with RFC 7616 and require clients to
provide a valid qop parameter. (markt)
+ Fix: Use Files API to create temporary docBase when antiLockingDocBase
is enabled. (markt)
+ Fix: Improve validation of configuration when DataSourceRealm starts.
(remm)
+ Fix: JAASRealm should do a logout if login does not fail outright but
does not produce a Principal. (remm)
+ Fix: Various edge cases for SSI substitutions, quoting and escaping.
+ Fix: unintentional conversion of literal + to a space during rule
processing in the RewriteValve. (markt)
* Coyote
+ Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native
is not available when the connector is explicitly configured to use
Tomcat Native with OpenSSL for TLS. (markt)
* Jasper
+ Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix
for 69333) was incomplete and tags that threw exceptions in doStartTag()
and doEndTag() were incorrectly re-used. This fix prevents tags from
being re-used if such an exception occurs. (markt)
+ Add: support for specifying Java 28 (with the value 28) as the compiler
source and/or compiler target for JSP compilation. If used with an
Eclipse JDT compiler version that does not support these values, a
warning will be logged and the default will be used. (markt)
* WebSocket
+ Fix: 70126: Fix WebSocket extension permessage-deflate so that it does
not drop bytes if a compressed message inflates to more than the
available buffer. Fix written by GPT-5.5. Test case written by Hironori
Ichimiya. (markt)
+ Fix: Optimise WebSocket client processing of server responses during
WebSocket HTTP upgrade process. (markt)
* Other
+ Update: to the Eclipse JDT compiler 4.40. (markt)
+ Update: Byte Buddy to 1.18.9. (markt)
+ Update: UnboundID to 7.0.5. (markt)
+ Update: JaCoCo to 0.8.15. (markt)
+ Update: BND to 7.3.0. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3454-1
Released: Mon Aug 3 13:45:25 2026
Summary: Security update for perl-HTTP-Date
Type: security
Severity: moderate
References: 1271705,CVE-2026-14741
This update for perl-HTTP-Date fixes the following issue
- CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in `parse_date` when processing specially crafted
date strings (bsc#1271705).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3455-1
Released: Mon Aug 3 13:46:45 2026
Summary: Security update for gawk
Type: security
Severity: moderate
References: 1271351,1271352,1271354,CVE-2026-40467,CVE-2026-40468,CVE-2026-40553
This update for gawk fixes the following issues:
- CVE-2026-40467: use-after-free in the `io.c` program file via the `do_getline_redir()` routine (bsc#1271351).
- CVE-2026-40468: integer overflow in the `builtin.c` program file (bsc#1271352).
- CVE-2026-40553: buffer overflow in the `extension/readdir.c` program file via the `ftype()` routine (bsc#1271354).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3458-1
Released: Mon Aug 3 14:00:20 2026
Summary: Security update for vim
Type: security
Severity: important
References: 1268162,1271193,1271194,1271195,1271684,CVE-2026-59856,CVE-2026-59857,CVE-2026-59858
This update for vim fixes the following issues:
This update for vim fixes the following issues:
Security issues fixed:
- CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
- CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
- CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).
Non security issue fixed:
- Guard suse.vimrc against re-entry to prevent an infinite sourcing
loop (bsc#1271684).
- allow 'wrap' and 'linebreak' to be set from a modeline (bsc#1268162).
Changes for vim:
- Updated to version 9.2.0780:
* filetype detect missing from completion (9.2.0726).
* popup images not rendered correctly when unfocused (9.2.0727).
* filetype: supertux info pattern is relative to current dir
(9.2.0728).
* % skips parens on continued quoted lines (9.2.0729).
* GTK4 GUI tabline is not updated (9.2.0730).
* GTK4 GUI scrollbar size not updated when restoring a session
(9.2.0731).
* session: terminal restored using absolute columns/rows (9.2.0732).
* GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
* function pointer passed to STRNCMP() instead of a length
(9.2.0734).
* tests: comment test can be improved (9.2.0737).
* completion: 'autocompletedelay' blocks the main loop and drops
autocommands (9.2.0739).
* GTK4: scrollbar wrongly displayed (9.2.0740).
* complete_check() does not return TRUE for mapped input (9.2.0741).
* filetype: SSH keys and related filetypes not recognized (9.2.0742).
* string macros silently accept a size of the wrong type (9.2.0743).
* popup_atcursor() closes immediately on white space (9.2.0744).
* cscope: connection leak when growing the array fails (9.2.0747).
* 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
* 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
* completion: 'autocompletedelay' deferral leaks state (9.2.0750).
* GTK3 GUI is slow under Wayland (9.2.0751).
* GTK4: drag-and-drop does not support HTML (9.2.0752).
* GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
* repeated completion length lookup in search_for_exact_line
(9.2.0754).
* 'autocomplete' behaves inconsistently when recording (9.2.0755).
* session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
* pum: no opacity when background not set for Popup menu group
(9.2.0758).
* some code for 'autocompletedelay' is no longer needed (9.2.0759).
* compiler warning for using potentially uninitialized var
(9.2.0760).
* runtime(netrw): Unix: unable to open '\' file (9.2.0761).
* duplicated sub-option name check in :set completion (9.2.0762).
* compiler warning about unused function (9.2.0764).
* popup: opacity popup over a terminal is not cleared when moved
(9.2.0765).
* quick_tab entries for empty letters point to the wrong index
(9.2.0766).
* legacy/vim9cmd modifiers do not set script version for options
values (9.2.0767).
* legacy/vim9cmd modifiers are not exclusive (9.2.0768).
* conversion to utf-16be using iconv is inconsistent (9.2.0769).
* dict_add_dict() has inconsistent ownership on failure (9.2.0770).
* dict_add_list() has inconsistent ownership on failure (9.2.0771).
* Vim9: null dereference inside alloc_type() (9.2.0772).
* memory leak in evalfunc.c on alloc failure (9.2.0773).
* memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
* memory leak in highlight_get_info() on alloc failure (9.2.0775).
* memory leak in sign_getlist() on alloc failure (9.2.0776).
* memory leak in add_defer() on alloc failure (9.2.0777).
* memory leak in compile_dict() on alloc failure (9.2.0778).
* memory leak in type_name_func() on alloc failure (9.2.0779).
* memory leak in evalvars.c on alloc failure (9.2.0780).
- Updated to version 9.2.0725:
* GTK: preedit font size is wrong for fractional point sizes (9.2.0532).
* '[ mark moved to end of inserted text after CTRL-R CTRL-P paste (9.2.0533).
* GTK UI does not support fullscreen mode (9.2.0534).
* GTK4: mouse popup menu does not show up at mouse pointer (9.2.0537).
* Cannot keep leading whitespace in %{} statusline expr (9.2.0538).
* filetype: too many Bitbake include files are recognized (9.2.0539).
* Vim9: endclass/endenum/endinterface can give errors (9.2.0541).
* Vim9: wrong error when redeclaring a typed variable (9.2.0543).
* GTK4: window blank after a resize or drag (9.2.0544).
* popup: blending uses hardcoded fallback colors (9.2.0545).
* configure: GTK4 build requires GTK >= 4.10 (9.2.0546).
* '%v' in 'errorformat' is affected by 'tabstop' (9.2.0547).
* GTK4: terminal and pty job output is not processed (9.2.0548).
* Cursor wrong after autoindent strip is skipped (9.2.0549).
* GTK4: 'mousehide' unhides cursor when switching tabs (9.2.0550).
* filetype: Tolk files are not recognized (9.2.0551).
* GTK4: F10 does nothing when the menubar is hidden (9.2.0552).
* runtime(netrw): netrw rejects hostnames containing _ (9.2.0553).
* GTK4: memory leak in free_menu() (9.2.0554).
* too many strlen() in ex_substitute() (9.2.0555).
* GTK4: scrollbars not shown and do not respond to clicks (9.2.0556).
* filetype: Kawasaki Robots files are not recognized (9.2.0557).
* filetype: Popcap Reanimation files are not recognized (9.2.0558).
* filetype: Kaitai struct files are not recogonized (9.2.0559).
* filetype: busybox shebang lines are not recognized (9.2.0560).
* [security]: possible code execution with python3complete (9.2.0561).
* filetype: SGF files are not recognized (9.2.0562).
* GTK3/Wayland: crash with right mouse-button in tabline (9.2.0563).
* GTK4: tabline does not respond to mouse clicks (9.2.0564).
* [security]: out-of-bounds read in update_snapshot() (9.2.0565).
* <C-w>f duplicates window if do_ecmd() is aborted (9.2.0566).
* dict function name allocation failure not handled (9.2.0567).
* pythoncomplete: g:pythoncomplete_allow_import had no effect (9.2.0568).
* out-of-bounds access in libvterm CSI 8 t resize (9.2.0569).
* GTK4: mouse wheel scrolling does not work correctly (9.2.0570).
* Vim9: memory leak in compile_nested_function() on failure (9.2.0571).
* lines disappear with wrapping virtual text after a double-width char (9.2.0572).
* Vim9: missing EX_WHOLE on some block keywords (9.2.0573).
* popup_create() not blocked in secure/sandbox (9.2.0576).
* GTK4: window resizing issues (9.2.0577).
* GTK4: :unmenu does not remove entries from the menubar (9.2.0578).
* :mksession, :mkview and :mkvimrc emit legacy Vim script (9.2.0579).
* xxd: binary output is not colored with -R (9.2.0580).
* After maximizing and deleting the quickfix buffer, window height is wrong (9.2.0581).
* GTK4: compile error when XFONTSET is defined (9.2.0582).
* completion: indent not ignored for fuzzy line completion (9.2.0583).
* GTK4: missing UI features (9.2.0584).
* line number wrong after undoing a deletion in quickfix buffer (9.2.0585).
* Crash with TextPut autocmd when pasting in terminal buffer (9.2.0586).
* GTK4: left scrollbar overlaps drawarea (9.2.0587).
* GTK4: drawing area loses focus after closing a menubar popover (9.2.0588).
* filetype: xinitrc files are not recognized (9.2.0589).
* GTK4: drawing area loses focus shape on popup menu open (9.2.0590).
* 'scrolljump' ignored when scrolling up (9.2.0591).
* Error when restoring session with terminal window (9.2.0592).
* :wqall ignores term_setkill() on running terminal buffers (9.2.0593).
* Use-after-free with ':wqall' and a running terminal job (9.2.0594).
* MS-Windows: Wrong buffer size calculation for gvimext (9.2.0595).
* cmdline completion popup cannot be scrolled with the mouse (9.2.0596).
* [security]: possible code execution with python complete (9.2.0597).
* popup: title set with popup_setoptions() is not shown (9.2.0599).
* clientserver method needs to be given as argument (9.2.0600).
* matchfuzzypos() returns garbage positions for long candidates (9.2.0601).
* popup: No opacity when background not set for Popup group (9.2.0602).
* possible heap-buffer-overflow when resizing the GUI (9.2.0603).
* GTK4: does not support all clipboard formats (9.2.0606).
* GTK4: inputdialog() does not work as expected (9.2.0607).
* popup_setoptions()/ch_setoptions() does not check secure mode (9.2.0608).
* completion info popup cannot be scrolled with the keyboard (9.2.0609).
* cindent: closing brace in a comment affects the next line's indent (9.2.0610).
* MS-Windows: evim.exe not working with VIMDLL (9.2.0611).
* Cannot render images in popup windows (9.2.0612).
* opacity popup leaves stale cells (9.2.0614).
* sixel encoder drops pixels on the right edge of shapes (9.2.0615).
* GTK4: use-after-free on clipboard read timeout (9.2.0616).
* GvimExt: does not support different runtime dirs (9.2.0617).
* use-after-free in popup_getoptions() on dict_add() failure (9.2.0618).
* integer overflow in popup image size validation (9.2.0619).
* runtime(netrw): fix 2match pattern rebuild (9.2.0620).
* 'autoindent' not stripped with virtualedit=onemore (9.2.0621).
* str2blob() does not work with wide UTF-16 encoding (9.2.0622).
* possible integer overflow in spellfile tree bounds check (9.2.0623).
* C-N/C-P cannot be mapped in complete() completion (9.2.0624).
* GTK4: Link error when Wayland is disabled (9.2.0625).
* Vim9: illegal characters allowed in dict key names with dot notation (9.2.0626).
* :vim9cmd source handles all scripts as Vim9 script (9.2.0627).
* popup image: wrong overlap layering, kitty laggy (9.2.0628).
* 0x80 and 0x9b byte not unescaped when check for valid abbr (9.2.0629).
* popup images: kitty images output in GUI mode (9.2.0630).
* DECRQM and SGR Mouse not supported in foot terminal (9.2.0631).
* GTK4: no support for hardware-accelerated rendering (9.2.0632).
* MS-Windows: No support for kitty graphics support in terminal (9.2.0633).
* GTK4: no minimum resize limit (9.2.0634).
* checking the syntax contains/cluster list is slow (9.2.0635).
* popup image: stale pixels under RGBA animation frames (9.2.0636).
* sixel: anti-aliased RGBA images render with visible outline (9.2.0637).
* cannot return matches containing spaces from a custom completion (9.2.0638).
* gq with 'formatprg' fails on an empty buffer (9.2.0639).
* the '%' command jumps to parens and braces inside comments (9.2.0640).
* GTK4: crash in gui_mch_menu_hidden() (9.2.0641).
* statusline: buffer overflow with item groups (9.2.0642).
* Missing Image ifdefs (9.2.0643).
* popup image: duplicate sync-output code (9.2.0644).
* Composing chars no longer accepted in end-id abbr (9.2.0645).
* GTK3 GUI slow on HiDPI/4K with software rendering (9.2.0646).
* matchfuzzypos() false exact match for long equal-length candidates (9.2.0647).
* MS-Windows: Compile warnings (9.2.0648).
* filetype: tf files sometimes incorrectly recognized (9.2.0649).
* Vim aborts at startup when built with the example -O2 CFLAGS (9.2.0650).
* completion: 'smartcase' doesn't work with 'longest' (9.2.0651).
* popup: stale kitty image after clipwindow scrolls out of view (9.2.0652).
* [security]: out-of-bounds write in tree_count_words() (9.2.0653).
* GTK4: using uninitialised colors in gui_mch_init() (9.2.0654).
* GTK4: missing NULL checks in vim_form_measure() (9.2.0655).
* completion: using wrong tolower() in smartcase filtering (9.2.0656).
* GTK4: missing menu when right-clicking in tabline (9.2.0657).
* xxd: signed integer overflow in huntype() (9.2.0658).
* GTK4: no balloon support in GUI (9.2.0659).
* Dragging the scrollbar does not trigger WinScrolled (9.2.0660).
* unintended wipe of Vim's temp dir, causes errors (9.2.0661).
* [security] Stack out-of-bounds write in dump_prefixes() (9.2.0662).
* [security]: runtime(netrw): code injection in local file deletion (9.2.0663).
* GTK4: GTK critical error on exit printed (9.2.0665).
* Terminal-Normal mode does not color empty lines with a background color (9.2.0666).
* patch 9.2.0590 was wrong (9.2.0667).
* GTK4: minimum horizontal size is too small (9.2.0668).
* GTK4: toolbar can be improved (9.2.0669).
* [security]: Out-of-bounds read with text properties (9.2.0670).
* [security]: possible out-of-bounds read with sodium encrypted files (9.2.0671).
* corrupted text property causes internal error (9.2.0672).
* configure: clears dynamic ruby linker flags (9.2.0674).
* MS-Windows: cannot switch to a buffer with '%' in its name (9.2.0676).
* Cannot clear the alternate file register # (9.2.0677).
* [security]: potential powershell code execution in zip.vim (9.2.0678).
* [security]: Out-of-bounds read with text property virtual text (9.2.0679).
* keytrans() doesn't replace '|' and '\' (9.2.0680).
* configure: -lruby added even for a dynamic ruby build (9.2.0681).
* Wrong dot-repeat when calling complete() while filtering completion (9.2.0682).
* filetype completion mishandles finished sub options (9.2.0683).
* :reg # does not display the value of the '#' register (9.2.0684).
* clipboard.c does not get the Wayland CFLAGS on GTK2 (9.2.0685).
* style: strcmp usage is inconsistent (9.2.0686).
* popup_image_composites_frames() has improper if block scope (9.2.0687).
* Terminal-Normal mode does not show the Visual selection on a colored empty line (9.2.0688).
* the '%' command is slow on a long line with many slashes (9.2.0689).
* Solaris: swap file names are too long (9.2.0690).
* Solaris: Test_terminal_composing_unicode() fails (9.2.0691).
* GTK2: build failure, popup images not drawn correctly (9.2.0692).
* Solaris: some tests faiures due to Solaris peculiarities (9.2.0694).
* Solaris: test_delete_temp_dir() fails because of missing flock (9.2.0695).
* GTK4: A few issues with toolbar support (9.2.0696).
* possible overflow when parsing CSI keys (9.2.0697).
* [security]: Out-of-bounds write with soundfold() (9.2.0698).
* [security]: possible code execution with python complete (9.2.0699).
* configure: -lrt requirement for timer_create not detected (9.2.0700).
* :windo and :tabdo create an extra window with 'winfixbuf' (9.2.0702).
* session file does not store relative Vim9 autoload imports (9.2.0703).
* GTK4: not handling mouse events (9.2.0704).
* :delete # silently fails to update '# and clobbers '0 (9.2.0705).
* completion: popup misplaced when text before it is concealed (9.2.0707).
* Leaks in do_autocmd in error case (9.2.0708).
* GTK4: a few minor issues (9.2.0709).
* GTK4 GUI resize handling can be improved (9.2.0710).
* leak in ins_compl_infercase_gettext() in error case (9.2.0711).
* GTK4: dialogs not handling mnemonics correctly (9.2.0712).
* completion: ruler not updated correctly when the popup menu is visible (9.2.0713).
* Coverity warns for NULL deref (9.2.0714).
* Coverity warns about copy/paste error in hl_blend_attr() (9.2.0715).
* filetype: not all supertux files are recognized (9.2.0716).
* :syn sync without an argument also lists syntax cluster (9.2.0718).
* GTK4: default menu is lacking (9.2.0719).
* GTK4: no support for browsefilter (9.2.0720).
* serverlist() returns strings separated by \n (9.2.0721).
* GTK4: find/replace dialog can be improved (9.2.0722).
* term_start() does not support 'noclose' (9.2.0723).
* use-after-free when freeing exit_cb job on exit (9.2.0724).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3493-1
Released: Tue Aug 4 14:11:00 2026
Summary: Security update for libpng16
Type: security
Severity: important
References:
This update for libpng16 fixes the following issues:
Changes for libpng16:
- version update to 1.6.58 (jsc#PED-16190).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3495-1
Released: Tue Aug 4 16:06:59 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1271645
This update for policycoreutils fixes the following issues:
- Drop /tmp cleanup to avoid TOCTOU issues (bsc#1271645):
* can be dropped once 'policycoreutils/scripts/fixfiles:
drop /tmp cleanup' is in the upstream release
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3531-1
Released: Fri Aug 7 17:11:25 2026
Summary: Recommended update for python-instance-billing-flavor-check
Type: recommended
Severity: moderate
References: 1261166
This update for python-instance-billing-flavor-check fixes the following issues:
- Update to version 1.0.2:
* Fix crashes with AttributeError when update servers are unreachable (bsc#1261166)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3541-1
Released: Mon Aug 10 14:50:04 2026
Summary: Security update for libssh2_org
Type: security
Severity: important
References: 1263890,1268546,1269567,1269568,1272734,1272735,1272736,1272737,CVE-2025-15661,CVE-2026-58050,CVE-2026-58051,CVE-2026-66032,CVE-2026-66033,CVE-2026-66034,CVE-2026-66035,CVE-2026-7598
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the `sftp_symlink()` function in `src/sftp.c` (bsc#1268546).
- CVE-2026-7598: integer overflow in function `userauth_password` of file `src/userauth.c` (bsc#1263890).
- CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response
(bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read
(bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3558-1
Released: Mon Aug 10 20:01:21 2026
Summary: Security update for perl
Type: security
Severity: important
References: 1266304,1268349,1271372,CVE-2026-12087,CVE-2026-57432,CVE-2026-8376
This update for perl fixes the following issues:
- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
(bsc#1266304).
- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure
(bsc#1268349).
- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`
(bsc#1271372).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3560-1
Released: Mon Aug 10 20:09:08 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1264962,1265268,1267581,1267821,1268375,1268977,1269066,1269788,1269959,1271192,CVE-2026-0864,CVE-2026-11940,CVE-2026-11972,CVE-2026-15308,CVE-2026-3276,CVE-2026-4360,CVE-2026-7210,CVE-2026-7774,CVE-2026-8328
This update for python311 fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).
- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding
protection (bsc#1264962).
- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory
(bsc#1267821).
- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
(bsc#1269788).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
(bsc#1271192).
Non security issue fixed:
- [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3567-1
Released: Tue Aug 11 07:34:13 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1259132,1271980
This update for grub2 fixes the following issues:
- Fix crash in booting kernel on some AMD systems (bsc#1271980)
- Fix broken bash completion on arm64 images when the bash-completion package
is not installed (bsc#1259132)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3578-1
Released: Tue Aug 11 15:58:41 2026
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1271712
This update for openssl-1_1 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3582-1
Released: Tue Aug 11 16:35:48 2026
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References:
This update for timezone fixes the following issues:
- Update to 2026c:
* Alberta moved to permanent -06 on 2026-06-18.
* Morocco moves to permanent +00 on 2026-09-20.
* More integer overflow bugs have been fixed in zic.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3592-1
Released: Wed Aug 12 11:15:00 2026
Summary: Security update for gzip
Type: security
Severity: moderate
References: 1269623,1272554,CVE-2026-41992
This update for gzip fixes the following issues:
- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state
between different decompression formats within a single execution (bsc#1269623).
- Crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access (bsc#1272554).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3600-1
Released: Wed Aug 12 13:59:10 2026
Summary: Security update for rpm
Type: security
Severity: important
References: 1240054,1269584,CVE-2026-44605
This update for rpm fixes the following issues:
Security issues fixed:
- CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot
table (bsc#1269584).
Other updates and bugfixes:
- Fix `libelf` handle not being closed, resulting in build errors when using a NFS buildroot (bsc#1240054).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3605-1
Released: Thu Aug 13 08:35:24 2026
Summary: Security update for openssh
Type: security
Severity: important
References: 1271044,1271046,1271048,1271049,1271052,1271053,1271054,1271055,CVE-2026-59995,CVE-2026-59996,CVE-2026-59997,CVE-2026-59998,CVE-2026-59999,CVE-2026-60000,CVE-2026-60001,CVE-2026-60002
This update for openssh fixes the following issues:
- Backported support for the mlkemx25519 key exchange from upstream (jsc#PED-16473).
- CVE-2026-59995: sftp: location of downloaded files not properly constrained when `sftp server:/path .` is used with
an attacker-controlled server (bsc#1271044).
- CVE-2026-59996: scp: file placed in the parent directory of an intended target directory when copy occurs between two
remote destinations (bsc#1271046).
- CVE-2026-59997: sshd: `internal-sftp` command lines are silently truncated after the 9th argument (bsc#1271048).
- CVE-2026-59998: sshd: undocumented security-relevant `GSSAPIStrictAcceptorCheck` behavior in Windows Active Directory
is not documented (bsc#1271049).
- CVE-2026-59999: sshd: `DisableForwarding=yes` does not override `PermitTunnel=yes` (bsc#1271052).
- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).
- CVE-2026-60001: sshd: minimum authentication delay is not honored (bsc#1271054).
- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange
(bsc#1271055).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3606-1
Released: Thu Aug 13 10:29:54 2026
Summary: Recommended update for tomcat11
Type: recommended
Severity: moderate
References: 1273184
This update for tomcat11 fixes the following issues:
- Fix executable bit on tomcat, tomcat-digest, tomcat-tool-wrapper (bsc#1273184)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3618-1
Released: Fri Aug 14 07:18:50 2026
Summary: Recommended update for apache-logging-parent, log4j
Type: recommended
Severity: moderate
References:
This update for apache-logging-parent, log4j fixes the following issues:
apache-logging-parent:
- Upgrade to logging-parent 12.1.1
* Main changes
+ Update to the latest upstream release (includes major updates
from versions 10, 11, and 12).
+ Better Security Tracking: Added tools (CycloneDX) to
automatically list all software ingredients (SBOM) used in the
build.
+ Updated Java Module Building: Swapped the old
maven-bundle-plugin for bnd-maven-plugin to better handle OSGi
and modern Java modules.
+ Stricter Code Quality: Added spotless-maven-plugin to enforce
a standard code style, and grouped bug-catching tools (Error
Prone, SpotBugs) into one place.
+ New Changelog System: Replaced the old Maven changes plugin
with a custom log4j-changelog-maven-plugin for managing
release notes.
+ Standardized Automation: Centralized GitHub Actions workflows
to make testing, building, and deploying more consistent
across projects.
+ Reliable Builds: Updated core Maven plugins and enforced
strict timestamp settings so that the same source code always
produces the exact same final files (reproducible builds).
log4j:
- Build with apache-logging-parent 12.1.1
+ Full osgi metadata generation
+ Bring back the annotation processing and generating the
Log4j2Plugins.dat descriptors
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3648-1
Released: Wed Aug 19 11:54:08 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1263083,CVE-2026-3276,CVE-2026-6019
This update for python311 fixes the following issues:
- Regression in `http.cookies` (bsc#1263083).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3657-1
Released: Thu Aug 20 19:06:03 2026
Summary: Security update for rsync
Type: security
Severity: important
References: 1269039,1269040,1269041,1269042,1269043,1269044,1269045,1269046,1269047,1269048,1269049,1269050,1269051,1269052,1269053,1269054,1269055,1269056,1269057,1269058,1269060,1273429,1273430,1273431,1273432,1273433,1273434,1273435,1273436,1273437,1273438,1273439,1273440,1273441,CVE-2026-53783,CVE-2026-53784,CVE-2026-53785,CVE-2026-53786,CVE-2026-53788,CVE-2026-53789,CVE-2026-53790,CVE-2026-53791,CVE-2026-53792,CVE-2026-53793,CVE-2026-53794,CVE-2026-53795,CVE-2026-53796,CVE-2026-53797,CVE-2026-53798,CVE-2026-53799,CVE-2026-53800,CVE-2026-53801,CVE-2026-53802,CVE-2026-53803,CVE-2026-70452,CVE-2026-70453,CVE-2026-70454,CVE-2026-70455,CVE-2026-70456,CVE-2026-70457,CVE-2026-70458,CVE-2026-70459,CVE-2026-70460,CVE-2026-70461,CVE-2026-70462,CVE-2026-70463,CVE-2026-70464
This update for rsync fixes the following issues:
- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
- CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
- CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement
(bsc#1269053).
- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
- CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege
escalation) (bsc#1269056).
- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion
outside the source tree (bsc#1269057).
- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure
(bsc#1269058).
- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths
(bsc#1269040).
- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant
to block (bsc#1273441).
- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs
(bsc#1273437).
- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory
transfer root (bsc#1273434).
- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-
module symlink (bsc#1273433).
- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
- CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule
(bsc#1273430).
- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3680-1
Released: Fri Aug 21 16:21:23 2026
Summary: Security update for vim
Type: security
Severity: important
References: 1275011,1275012,1275013,1275014,1275015,1275016,1275017,1275018,CVE-2026-73070,CVE-2026-73071,CVE-2026-73072,CVE-2026-73074,CVE-2026-73075,CVE-2026-73076,CVE-2026-73077,CVE-2026-73078
This update for vim fixes the following issues:
- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution
(bsc#1275016).
- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution
(bsc#1275015).
- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).
Changes for vim:
- Updated to version 9.2.0957.
* tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
* tests: missing cleanup in test_mksession.vim (9.2.0782).
* tests: personal spell files leak into later tests (9.2.0783).
* crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
* WinResized not triggered when the whole Vim is resized (9.2.0785).
* filetype: containerfile is not recognized (9.2.0786).
* regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
* filetype: hip files are not recognized (9.2.0788).
* 'statuslineopt' status line too high after a window is minimized (9.2.0789).
* 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
* wincol() counts from right side for 'rightleft' (9.2.0791).
* runtime(netrw): explore without optional dir broken (9.2.0792).
* if session restored a tiny window, restore fails (9.2.0793).
* extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
* popup menu shadow is not cleared when the menu shrinks (9.2.0795).
* Visual block reselection wrong with 'virtualedit' (9.2.0796).
* memory leak in get_qfline_items() on alloc failure (9.2.0797).
* memory leak in compile_expr6() on alloc failure (9.2.0798).
* memory leak in compile_def_function_body() on alloc failure (9.2.0799).
* memory leak in call_func() on alloc failure (9.2.0800).
* memory leak in f_getreginfo() on alloc failure (9.2.0801).
* memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
* memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
* wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
* screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
* 'showcmd' may show internal command keys (9.2.0806).
* MS-Windows: ellipsis character is garbled (9.2.0807).
* getregionpos: double-free on alloc failure (9.2.0808).
* getframelayout() uses wrong function to free lists (9.2.0809).
* add_llist_tags() uses wrong function to free dict (9.2.0810).
* mksession writes terminal command unquoted (9.2.0811).
* :argdelete with pattern leads to wrong argidx() (9.2.0812).
* dict_add_func() may corrupt funcref count on failure (9.2.0813).
* Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
* deeply nested regexp patterns may cause stack overflow (9.2.0815).
* GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
* crash when building a stacktrace during an autocommand (9.2.0817).
* tests: client-server test fails without X11 server (9.2.0818).
* MS-Windows: sixel image shown as raw text in the console (9.2.0819).
* GUI: hidden popup image is displayed and not erased (9.2.0820).
* filetype: msmtp system-wide rc file not detected (9.2.0821).
* GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
* tests: Test_clientserver_servlist_list may fail (9.2.0823).
* Makefile: make tags depends on configure (9.2.0824).
* regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
* highlighting for broken terminals can be improved (9.2.0826).
* :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).
* GTK4: hardware rendering can be improved (9.2.0828).
* sessions do not preserve script version for expression options (9.2.0829).
* the completion menu is not used on terminals without colors (9.2.0830).
* diff highlighting hard to read with syntax enabled (9.2.0831).
* socketserver: remote commands can be processed in reverse order (9.2.0832).
* GTK4: menu mnemonics do not work properly (9.2.0833).
* cleared last search pattern is restored from viminfo (9.2.0834).
* features in version.c are not sorted (9.2.0835).
* filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).
* using wrong colors in hl_blend_attr() (9.2.0837).
* searchcount() returns wrong cached maxcount (9.2.0838).
* [security]: arbitrary code execution via keyword lookup (9.2.0839).
* [security]: code injection in netrw via bookmarks (9.2.0840).
* [security]: heap overflow when adding > 65535 text properties (9.2.0841).
* [security]: stack buffer overflow in socket server (9.2.0842).
* [security]: popup: opacity mask indexed out of bounds (9.2.0843).
* [security]: use-after-free on json decode error (9.2.0844).
* [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).
* [security]: heap buffer overflow in set_sofo() (9.2.0846).
* [security]: vimball: code execution via .VimballRecord file (9.2.0847).
* tagfunc 'cmd' with a generic Ex command corrupts the tag entry (9.2.0848).
* filetype: osquery config files are not recognized (9.2.0849).
* MS-Windows: commands from a client can be lost (9.2.0850).
* focus autocommands triggered inconsistently (9.2.0851).
* GTK: ligatures not correctly displayed (9.2.0852).
* popup: popup images do not support scaling (9.2.0853).
* memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).
* 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).
* GTK4: undercurl rendering is inefficient (9.2.0856).
* popup: opacity popup over a terminal is not cleared when closed (9.2.0857).
* MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).
* GTK2: link error (9.2.0859).
* filetype: xilinx design constraint files are not recognized (9.2.0860).
* GTK4: bleed region updates in jumps (9.2.0861).
* missing test change from v9.2.0857 (9.2.0862).
* MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).
* using some dead code in Wayland feature (9.2.0864).
* GTK4: non-hardware accelerated UI is too slow (9.2.0865).
* MS-Windows: ':language messages' only works once (9.2.0866).
* MS-Windows: messages are not in the display language (9.2.0867).
* GTK: window Manager hint prevents giving focus to dialog (9.2.0868).
* buf_copy_options() can lose the P_INSECURE flag (9.2.0869).
* filetype: marko files are not recognized (9.2.0870).
* screen line is lost when splitting a 'winfixheight' window (9.2.0871).
* popup with opacity does not use the font of the highlight group (9.2.0872).
* :redrawstatus does not update the ruler of the last window (9.2.0873).
* fold size is compared against 'foldminlines' of the wrong window (9.2.0874).
* GTK4: GUI does not support command-line arguments (9.2.0875).
* GTK4: compile error with disabled netbeans feat (9.2.0876).
* Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).
* Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).
* popup: 'maxwidth' is not respected when 'wrap' is off (9.2.0879).
* scroll: window scrolls when using the autocommand window (9.2.0880).
* 'smoothscroll' position is lost when the window height changes (9.2.0881).
* :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).
* scroll: 'smoothscroll' position is lost when using '|' (9.2.0883).
* scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).
* scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).
* :set completion works for an invalid sub-option name (9.2.0886).
* scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).
* mapping: modifier is not recognized after a partial mapping (9.2.0888).
* VMS: spurious 'INVALID DECC FEATURE VALUE' message at every startup (9.2.0889).
* test: test for patch v9.2.0888 can be clarified (9.2.0890).
* MS-Windows: filename-modifier ':8:t' causes underflow (9.2.0891).
* highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).
* MS-Windows: '*.vim' also matches files with a longer extension (9.2.0893).
* filetype: ed script files not recognised (9.2.0894).
* test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).
* scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).
* GTK3 X11 redraws are not coalesced (9.2.0897).
* printing support is lacking (9.2.0898).
* command output temporary files may collide (9.2.0899).
* FocusGained still triggered when closing dialog (9.2.0900).
* textprop: wrong cursor line with truncated virtual text (9.2.0901).
* Vim9: iterating over a tuple leaks memory (9.2.0902).
* Vim9: cannot use an exported function of an autoload import (9.2.0903).
* 'zb' scrolls incorrectly with cursor just above fold (9.2.0904).
* MS-Windows: ghost cursor with ligatures (9.2.0905).
* slow transstr() with long strings (9.2.0906).
* popup: virtual text is not redrawn when a text property changes (9.2.0907).
* cannot use a {} block in a nested :autocmd (9.2.0908).
* insert completion is slow to collect many matches (9.2.0909).
* runtime(vim): update syntax, contain Ex commands (9.2.0910).
* makefiles do not build hardcopy_postscript.c (9.2.0911).
* hardcopy: prototypes are hand-written instead of generated (9.2.0912).
* statusline: cell below the vertical separator keeps the old highlight (9.2.0913).
* diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).
* tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).
* configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).
* :quitall not allowed in the command-line window (9.2.0917).
* screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).
* screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).
* filetype: json-ld files are not recognized (9.2.0920).
* test: terminal tests fail on FreeBSD (9.2.0921).
* Wayland: modeless selection not redrawn (9.2.0922).
* tabpage: closing a tab page loses the alternate tab page (9.2.0923).
* tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).
* crash when getcompletiontype() gets a NULL string (9.2.0925).
* filetype: business Central files are not recognized (9.2.0926).
* curswant not set on 8g8 (9.2.0927).
* MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).
* incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).
* floating point exception when displaying pum (9.2.0930).
* the GTK4 GUI is still experimental and untested by CI (9.2.0931).
* NFA engine fallback can double free the compiled program (9.2.0932).
* u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).
* filetype: hlsl files are not recognized (9.2.0934).
* reading an undo file is slow with many undo headers (9.2.0935).
* stringifying a list or dict can free the item being iterated (9.2.0936).
* sort() with a numeric option converts each item on every comparison (9.2.0937).
* cursorbind: cursor in the other window is not updated after undo (9.2.0938).
* mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).
* GTK4: columns are lost when a scrollbar appears (9.2.0940).
* tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).
* test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).
* test: test_hardcopy fails on GTK4 UI (9.2.0943).
* test: tests fail when checking for GTK4 feature (9.2.0944).
* sort() with a numeric option can be improved (9.2.0945).
* GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).
* GTK4: screen is cleared when moving the mouse after startup (9.2.0947).
* GTK4: mouse move starts Visual selection after a dialog (9.2.0948).
* GDK_KEY_VoidSymbol might be undefined (9.2.0949).
* transstr() can be improved (after 9.2.0906) (9.2.0950).
* GTK3: cursor does no longer blink (9.2.0951).
* locking a container while stringifying can be improved (9.2.0952).
* insert completion code can be improved (9.2.0953).
* u_read_undo() can be improved (after 9.2.0935) (9.2.0954).
* tests: terminal tests are flaky (9.2.0955).
* GTK4: crash when the window is resized while redrawing (9.2.0956).
* filetype: ArgoCD config file is not recognized (9.2.0957).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3684-1
Released: Fri Aug 21 20:23:10 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free read in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices (bsc#1261606).
- Several security issues in releases prior to v2.42.2 and v2.41.5 (bsc#1268886).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3798-1
Released: Tue Aug 25 14:40:59 2026
Summary: Security update for curl
Type: security
Severity: moderate
References: 1262632,1262633,1262635,1262636,1262638,1263440,1268412,CVE-2026-5545,CVE-2026-5773,CVE-2026-6253,CVE-2026-6276,CVE-2026-6429,CVE-2026-7168,CVE-2026-8926
This update for curl fixes the following issues:
- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).
- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).
- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).
- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).
- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3835-1
Released: Thu Aug 27 13:53:51 2026
Summary: Security update for openssl, openssl-3
Type: security
Severity: important
References: 1216950,1236136,1236599,1243014,1243459,1243564,1247463,1250233,1250234,1256829,1256831,1256832,1256833,1257274,1259652,1261678,1266344,1266347,CVE-2024-12797,CVE-2024-13176,CVE-2024-9143,CVE-2025-11187,CVE-2025-15468,CVE-2025-15469,CVE-2025-27587,CVE-2025-4575,CVE-2025-66199,CVE-2025-9231,CVE-2025-9232,CVE-2026-2673,CVE-2026-28390,CVE-2026-34182,CVE-2026-42764
This update for openssl, openssl-3 fixes the following issues:
OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)
* Enables Post-Quantum Cryptography (PQC) TLS support
Security issues fixed:
* CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
* CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
* CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
* CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652)
* CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833)
* CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB (bsc#1256832)
* CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829)
* CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831)
* CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
* CVE-2025-9232: Fix out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
* CVE-2025-4575: Fix the x509 application adding trusted use instead of rejected use (bsc#1243564)
* CVE-2025-27587: Minerva side channel vulnerability in P-384 (bsc#1243459)
* CVE-2024-12797: Fixed RFC7250 handshakes with unauthenticated servers don't abort as
expected. (bsc#1236599)
* CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation.
* CVE-2024-9143: Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
* CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)
POWER performance enhancements:
* Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)
- Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)
- Fix check %{suse_version} > 1600 (jsc#PED-15816)
- Fix NULL pointer dereference when processing an OCSP response
- Remove showciphers.c in favor of openssl ciphers
- Use %ldconfig_scriptlets
- Enable livepatching support for ppc64le [bsc#1257274]
- Move ssl configuration files to the libopenssl package [bsc#1247463]
- Don't install unneeded NOTES
- Disable LTO for userspace livepatching [jsc#PED-13245]
- Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]
- FIPS: Fix the speed command in FIPS mode for KMAC
- FIPS: Restore the check to deny SHA1 signatures in FIPS mode and
the functionality to allow/deny via crypto-policies. [jsc#PED-12224]
Update to 3.5.0:
* Changes:
- Default encryption cipher for the req, cms, and smime applications
changed from des-ede3-cbc to aes-256-cbc.
- The default TLS supported groups list has been changed to include
and prefer hybrid PQC KEM groups. Some practically unused groups
were removed from the default list.
- The default TLS keyshares have been changed to offer X25519MLKEM768
and and X25519.
- All BIO_meth_get_*() functions were deprecated.
* New features:
- Support for server side QUIC (RFC 9000)
- Support for 3rd party QUIC stacks including 0-RTT support
- Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
- A new configuration option no-tls-deprecated-ec to disable support
for TLS groups deprecated in RFC8422
- A new configuration option enable-fips-jitter to make the FIPS
provider to use the JITTER seed source
- Support for central key generation in CMP
- Support added for opaque symmetric key objects (EVP_SKEY)
- Support for multiple TLS keyshares and improved TLS key establishment
group configurability
- API support for pipelining in provided cipher algorithms
Changes between 3.3.0 and 3.4.0:
* Changes:
- Deprecation of TS_VERIFY_CTX_set_* functions and addition of
replacement TS_VERIFY_CTX_set0_* functions with improved semantics
- The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has fips=no property.
- SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the xoflen param is set before.
- Setting config_diagnostics=1 in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an
error in the ssl module configuration.
- An empty renegotiate extension will be used in TLS client hellos
instead of the empty renegotiation SCSV, for all connections with a
minimum TLS version > 1.0.
- Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and
SSL_CTX_flush_sessions() functions in favor of their respective _ex
functions which are Y2038-safe on platforms with Y2038-safe time_t
* New features:
- Support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions
- FIPS indicators support in the FIPS provider and various updates of
the FIPS provider required for future FIPS 140-3 validations
- Implementation of RFC 9579 (PBMAC1) in PKCS#12
- An optional additional random seed source RNG JITTER using a statically
linked jitterentropy library
- New options -not_before and -not_after for explicit setting start and
end dates of certificates created with the req and x509 apps
- Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
- Support for retrieving certificate request templates and CRLs in CMP
- Support for additional X.509v3 extensions related to Attribute Certificates
- Initial Attribute Certificate (RFC 5755) support
- Possibility to customize ECC groups initialization to use precomputed
values to save CPU time and use of this feature by the P-256 implementation
Changes between 3.2.0 and 3.3.0:
* Changes:
- Optimized AES-CTR for ARM Neoverse V1 and V2
- Various optimizations for cryptographic routines using RISC-V vector
crypto extensions
- Added assembly implementation for md5 on loongarch64
- Accept longer context for TLS 1.2 exporters
- The activate and soft_load configuration settings for providers in
openssl.cnf have been updated to require a value of [1|yes|true|on]
(in lower or UPPER case) to enable the setting. Conversely a value of
[0|no|false|off] will disable the setting.
- In openssl speed, changed the default hash function used with hmac from
md5 to sha256.
- The -verify option to the openssl crl and openssl req will make the
program exit with 1 on failure.
- The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(),
and related functions have been augmented to check for a minimum length
of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
- OPENSSL_sk_push() and sk__push() functions now return 0 instead of -1
if called with a NULL stack argument.
- New limit on HTTP response headers is introduced to HTTP client.
The default limit is set to 256 header lines.
* Bug fixes and mitigations:
- The BIO_get_new_index() function can only be called 127 times before
it reaches its upper bound of BIO_TYPE_MASK and will now return -1
once its exhausted.
* new features:
- Support for qlog for tracing QUIC connections has been added
- Added APIs to allow configuring the negotiated idle timeout for QUIC
connections, and to allow determining the number of additional streams
that can currently be created for a QUIC connection.
- Added APIs to allow disabling implicit QUIC event processing for QUIC
SSL objects
- Added APIs to allow querying the size and utilisation of a QUIC
stream's write buffer
- New API SSL_write_ex2, which can be used to send an end-of-stream (FIN)
condition in an optimised way when using QUIC.
- Limited support for polling of QUIC connection and stream objects in a
non-blocking manner.
- Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
- The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
output length.
- The EVP_PKEY_fromdata function has been augmented to allow for the
derivation of CRT (Chinese Remainder Theorem) parameters when requested
- Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
is enabled.
- Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
config
options and the respective calls to SSL[_CTX]_set1_sigalgs() and
SSL[_CTX]_set1_client_sigalgs() that start with ? character are ignored
and the configuration will still be used.
- Added -set_issuer and -set_subject options to openssl x509 to override
the Issuer and Subject when creating a certificate. The -subj option
now is an alias for -set_subject.
- Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
- New option SSL_OP_PREFER_NO_DHE_KEX, which allows configuring a TLS1.3
server to prefer session resumption using PSK-only key exchange over
PSK with DHE, if both are available.
- New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded.
- Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
- Support for using certificate profiles and extened delayed delivery in CMP
- FIPS: Mark SHA-1 as non-approved in the SLI. [jsc#PED-12224]
- Introduce --without lto. When %{optflags} contains -flto=*, tests cases are
also built using -flto=* which significantly increases build times, this
option disables lto which improve iteration times when developing.
Update to 3.2.4:
- Remove the engines' directories and symlinks that were added to
allow parallel installations with openssl-1_1.
- Add ktls capability [bsc#1216950]
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3899-1
Released: Mon Aug 31 17:05:52 2026
Summary: Security update for sssd
Type: security
Severity: important
References: 1273009,1273922,1273924,1273925,CVE-2026-68742,CVE-2026-68743,CVE-2026-68744
This update for sssd fixes the following issues:
- CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read
(bsc#1273922).
- CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads
(bsc#1273925).
- CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure
(bsc#1273924).
Changes for sssd:
- Warn about ldap_sudo_search_base only if sudo target is
enabled; (bsc#1273009)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3927-1
Released: Thu Sep 3 06:27:06 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1259542,1275902
This update for shadow fixes the following issues:
- Mark /etc/default/useradd as %config(noreplace) to restore the behavior
prior to the file being removed from shadow. (bsc#1275902)
- Fix regression caused in (bsc#1259542)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3938-1
Released: Thu Sep 3 09:29:58 2026
Summary: Security update for apr-util
Type: security
Severity: critical
References: 1207866,1274235,1274237,1274850,1274852,1274854,CVE-2022-25147,CVE-2025-49506,CVE-2026-32327,CVE-2026-34191,CVE-2026-34501,CVE-2026-34502
This update for apr-util fixes the following issues:
- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
- CVE-2026-32327: XML stack recursion crash (bsc#1274235).
- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3939-1
Released: Thu Sep 3 09:31:26 2026
Summary: Security update for libvirt
Type: security
Severity: moderate
References: 1266364,1274576,1274946,1275264,1275265,1275863,CVE-2026-18917,CVE-2026-61477,CVE-2026-63622,CVE-2026-63623,CVE-2026-77159
This update for libvirt fixes the following issues:
- CVE-2026-18917: remote: Fix integer overflow in RPC handler for virNodeGetFreePages (bsc#1275863)
- CVE-2026-63622: util: virFileChownFiles: do not follow symlinks (bsc#1275264)
- CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert (bsc#12075265)
- CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file (bsc#1274946)
- CVE-2026-61477: Reject line breaks in network config (bsc#1274576)
- qemu: Fix invocation of numa-preplace when hugepages requested, but page size not specified (bsc#1266364)
- Add ClearwaterForest CPU model (jsc#PED-16192)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3956-1
Released: Thu Sep 3 10:04:30 2026
Summary: Recommended update for perl-Bootloader
Type: recommended
Severity: moderate
References: 1246013,1271602
This update for perl-Bootloader fixes the following issues:
- Update to version 1.28:
* fix test suite
* adjust two tests
* add test case
* updated test results
* fix command line parser (bsc#1271602)
* fix and reenable ksh tests: ksh uses alts now
* update ksh test results
- Update to version 1.27:
* adjust spec file for immutable mode: switch to using
* systemd-tmpfiles (jsc#PED-14833)
- Update to version 1.26:
* adjust test cases
- Implement config for BLS (bsc#1246013)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3979-1
Released: Sun Sep 6 09:43:09 2026
Summary: Recommended update for python-rpm-macros
Type: recommended
Severity: moderate
References:
This update for python-rpm-macros fixes the following issues:
- Sync with slfo-main
- Update to version 20260821.08c5ec8:
* Use the primary interpreter for generic python3 macros
* Add python315 macros, remove python39
- Update to version 20260629.bcd36db:
* don't use realpath to the interpreter binary
* doc: add a shot documentation text for %python_site{lib,arch}_module.
* Add initial pyproject declarative buildsystem
* fix: handle the situation when either `name` or `meta_name` is not found
* Consolidate site directory name normalization into %__python_sitedir_name
* Normalize the name of the directory
* Definitions of %python_site{lib,arch}_module macros.
- Update to version 20260601.4a231f4:
* fix: allow function of `%pythonXX_provides` w/o /usr/bin/python3
* Update python version handling in default-prjconf
* Rewrite README.md to have headlines for each macro.
- Allow function of `%pythonXX_provides` even without the access to /usr/bin/python3.
- Update to version 20260317.5e02b19:
* fix: don't double escape %{**} code.
* Copy libalternatives binaries from buildroot to flavorbin
- Update to version 20250923.c3cfac8:
* Remove py_setup_args macro completely.
* Move libalternative conf creation to FLAVOR_alternative_conf
* Update default-prjconf for primary python: python313
* Drop python38, add python314
* Make RPM macro expansions POSIX sh-compatible
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3980-1
Released: Sun Sep 6 09:44:23 2026
Summary: Recommended update for libtirpc
Type: recommended
Severity: important
References: 1274740
This update for libtirpc fixes the following issues:
- Fix: Possible mem leak from libtirpc [ thread::XRF51s_MK4mkPFEu7JKj0Ss:: ] (bsc#1274740):
* rpcb_clnt.c: fix memory leak in destroy_addr
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4000-1
Released: Mon Sep 7 09:24:53 2026
Summary: Security update for libidn
Type: security
Severity: moderate
References: 1268965,CVE-2026-57053
This update for libidn fixes the following issue:
- CVE-2026-57053: out-of-bounds read in `ToUnicode` APIs (bsc#1268965).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4002-1
Released: Mon Sep 7 09:27:14 2026
Summary: Security update for java-17-openjdk
Type: security
Severity: moderate
References: 1275035,1275764,1275777,1275778,CVE-2026-60589,CVE-2026-61308,CVE-2026-70907
This update for java-17-openjdk fixes the following issues:
Upgrade to upstream tag jdk-17.0.20.1+1 (August 2026 CSPU).
- CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access
to a subset of accessible data (bsc#1275777).
- CVE-2026-61308: unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data
(bsc#1275778).
- CVE-2026-70907: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1275764).
Changes for java-17-openjdk:
- Upgrade to upstream tag jdk-17.0.20.1+1 (August 2026 CSPU):
+ JDK-8389947: [17u] Remove designator `DEFAULT_PROMOTED_VERSION_PRE=ea` for release 17.0.20.1.
+ JDK-8333743: Change `.jcheck/conf` branches property to match valid branches
+ JDK-8388790: Bump update version for OpenJDK: jdk-17.0.20.1
- Backport upcoming upgrade of timezone data (bsc#1275035)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4012-1
Released: Mon Sep 7 09:34:33 2026
Summary: Security update for cpio
Type: security
Severity: moderate
References: 1274856,1274857,1274858,CVE-2026-66484,CVE-2026-66485,CVE-2026-66486
This update for cpio fixes the following issues:
- CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard
links outside intended directory via malicious tar archives (bsc#1274856).
- CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of
service via crafted archives (bsc#1274857).
- CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for
terminal control sequence injection via crafted archive member names (bsc#1274858).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4014-1
Released: Mon Sep 7 09:36:08 2026
Summary: Security update for postgresql18
Type: security
Severity: important
References: 1275001,1275002,1275042,1275043,1275044,1275046,1275047,1275048,1275049,1275050,1275051,1275052,1275053,1275054,1275055,1275056,1275057,1275058,1275059,1275060,1275061,1275062,1275063,1275064,1275065,1275066,1275067,1275068,CVE-2026-14662,CVE-2026-14663,CVE-2026-14664,CVE-2026-14666,CVE-2026-14668,CVE-2026-14669,CVE-2026-14670,CVE-2026-14671,CVE-2026-14672,CVE-2026-14673,CVE-2026-14676,CVE-2026-14677,CVE-2026-14678,CVE-2026-14679,CVE-2026-14680,CVE-2026-14681,CVE-2026-15741,CVE-2026-15742,CVE-2026-16238,CVE-2026-16239,CVE-2026-16241,CVE-2026-18024,CVE-2026-18408,CVE-2026-19385,CVE-2026-6464,CVE-2026-6469,CVE-2026-6470,CVE-2026-6471
This update for postgresql18 fixes the following issues:
- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).
- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).
- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).
- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).
- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).
- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
(bsc#1275002).
- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).
- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read
(bsc#1275066).
- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).
- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).
- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).
- CVE-2026-14672: observable response discrepancy with non-default `scram_iterations` provides user existence
oracle (bsc#1275062).
- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).
- CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).
- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).
- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).
- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).
- CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
- CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).
- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
- CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).
- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).
- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).
- CVE-2026-18408: `psql` `\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`
client (bsc#1275048).
- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).
Changes for postgresql18:
- Update to version 18.6:
* https://www.postgresql.org/docs/18/release-18-6.html
* https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4021-1
Released: Mon Sep 7 09:41:23 2026
Summary: Security update for c-ares
Type: security
Severity: important
References: 1220279,1240955,1254738,1270416,1276290,1276291,CVE-2024-25629,CVE-2025-31498,CVE-2025-62408,CVE-2026-33630,CVE-2026-69184,CVE-2026-69186
This update for c-ares fixes the following issues:
- CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).
- CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
- CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via
ares_getaddrinfo() over TCP (bsc#1270416).
- CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
- CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).
Changes for c-ares:
- updated to 1.36.8.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4028-1
Released: Mon Sep 7 09:45:04 2026
Summary: Security update for httpcomponents-client
Type: security
Severity: moderate
References: 1273163,CVE-2026-64607
This update for httpcomponents-client fixes the following issue:
- CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported
`Content-Encoding` header value in a response message (bsc#1273163).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4029-1
Released: Mon Sep 7 09:45:31 2026
Summary: Security update for nghttp2
Type: security
Severity: moderate
References: 1269489,CVE-2026-58055
This update for nghttp2 fixes the following issue:
- CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning
(bsc#1269489).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4039-1
Released: Mon Sep 7 10:29:11 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4041-1
Released: Mon Sep 7 10:29:44 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1274774,1274788,1274795,CVE-2026-54874,CVE-2026-63072
This update for openssl-1_1 fixes the following issues:
August 2026 release.
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4046-1
Released: Mon Sep 7 15:53:10 2026
Summary: Security update for perl-URI
Type: security
Severity: moderate
References: 1277886,CVE-2026-19953
This update for perl-URI fixes the following issue:
- CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in `nameprep`
(bsc#1277886).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4048-1
Released: Mon Sep 7 15:54:05 2026
Summary: Security update for curl
Type: security
Severity: low
References: 1277476,1277479,1277480,CVE-2026-13608,CVE-2026-80229,CVE-2026-80230
This update for curl fixes the following issues:
- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4050-1
Released: Mon Sep 7 15:55:07 2026
Summary: Security update for libusb-1_0
Type: security
Severity: moderate
References: 1266664,CVE-2026-23679
This update for libusb-1_0 fixes the following issue:
- CVE-2026-23679: NULL pointer dereference in `parse_interface()` allows attackers to crash applications by supplying a
malformed USB configuration descriptor (bsc#1266664).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4055-1
Released: Mon Sep 7 17:48:12 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4076-1
Released: Tue Sep 8 09:10:44 2026
Summary: Security update for python-tornado6
Type: security
Severity: important
References: 1277725,CVE-2026-82397
This update for python-tornado6 fixes the following issue
- CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously
stall the single-threaded event loop and delay every connection (bsc#1277725).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4092-1
Released: Tue Sep 8 18:31:37 2026
Summary: Security update for libzypp, zypper
Type: security
Severity: critical
References: 1257249,1261038,1268321,1271730,1272534,1273242,1274091,1274625,1277790
This update for libzypp, zypper fixes the following issues:
Security issue fixed:
- invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625).
- hasCredentials() requires both username AND password to be non-empty (bsc#1273242).
- GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730).
Non security issues fixed:
- Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534).
- libzypp: X-ZYpp-AnonymousId header anomaly (bsc#1268321).
- Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249).
- zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).
- Zypper patch doesn't give enough details about conflicts (bsc#1277790).
- dependency issue for package 'python3-vsts-cd-manager' after starting the upgrade (bsc#1261038).
Changes for libzypp:
- Update to version 17.38.15:
- Prevent libgpgme from launching gpg-agents; we don't need them.
- defaultLoadSystem: Hand out the ZYpp::Ptr as return value.
- Replace popen cat/zcat with solv_xfopen for testcase loaders
(fixes #749)
- zypp: Improve Testcase Loading for MCP Tools.
- spec: Remove useless %bcond visibility_hidden (is always ON in
cmake)
- zypp.conf: add solver.NoUpdateProvide (default: false) option.
Changes for zypper:
- Update to version 1.14.101.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4097-1
Released: Wed Sep 9 13:01:33 2026
Summary: Recommended update for postfix
Type: recommended
Severity: moderate
References: 1274991
This update for postfix fixes the following issues:
- L3: un-time library vs. compile-time header version mismatch:
OpenSSL 3.2.0 may not be compatible with OpenSSL 3.1.0
(bsc#1274991)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4110-1
Released: Wed Sep 9 17:00:16 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1212476,1227370,1236165,1239009,1242233,1243830,1252696,1253025,1258311,1259825,1262315,1275660
This update for crypto-policies fixes the following issues:
- Update crypto-policies for Post-Quantum Cryptography (PQC) TLS
support in SLE-15-SP7 (jsc#PED-16072):
* Add support for mlkem768x25519-sha256 in openssh 9.6p1 (bsc#1275660)
* Add support for python36 (jsc#PED-16072)
* Add support for sntrup761x25519-sha512 at openssh.com and remove
it for sntrup761x25519-sha512 in openssh 9.6p1 in SLE-15-SP7
as it only lists the former (bsc#1258311, bsc#1259825)
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
- Adapt the manpages to SUSE/openSUSE:
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: [bsc#1253025, bsc#1252696]
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
- Allow openssl to load when using the DEFAULT policy, and also
other policies, in FIPS mode. [bsc#1243830, bsc#1242233]
- Relax the nss version requirement since the mlkem768secp256r1
enablement has been reverted.
- Allow sshd in FIPS mode when using the DEFAULT policy [bsc#1227370]
- Enable SHA1 sigver in the DEFAULT policy.
- Remove also sequoia config and generator files
- Remove not needed fips bind mount service
- Update to version 20250124.4d262e7: [bsc#1239009, bsc#1236165]
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-setup-helper: add a libexec helper for anaconda
* fips-crypto-policy-overlay: automount FIPS policy
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* CONTRIBUTING.md: add a small section on updating policies
* CONTRIBUTING.md: remove trailing punctuation from headers
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
* nss: unconditionally load p11-kit-proxy.so
* gnutls: make DTLS0.9 controllable again
* gnutls: retire GNUTLS_NO_TLS_SESSION_HASH
* openssh: remove OPENSSH_MIN_RSA_SIZE / OPENSSH_MIN_RSA_SIZE_FORCE
* gnutls: remove extraneous newline
* sequoia: move away from subprocess.getstatusoutput
* python/cryptopolicies/cryptopolicies.py: add trailing commas
* python, tests: rename MalformedLine to MalformedLineError
* Makefile: introduce SKIP_LINTING flag for packagers to use
* Makefile: run ruff
* tests: use pathlib
* tests: run(check=True) + CalledProcessError where convenient
* tests: use subprocess.run
* tests/krb5.py: check all generated policies
* tests: print to stderr on error paths
* tests/nss.py: also use encoding='utf-8'
* tests/nss.py: also use removesuffix
* tests/nss.py: skip creating tempfiles
* tests/java.pl -> tests/java.py
* tests/gnutls.pl -> tests/gnutls.py
* tests/openssl.pl -> tests/openssl.py
* tests/verify-output.pl: remove
* libreswan: do not use up pfs= / ikev2= keywords for default behaviour
- Update to version 20241010.5930b9a:
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* nss: be stricter with new purposes
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* TEST-PQ: disable pure Kyber768
* nss: wire XYBER768D00 to X25519-KYBER768
* TEST-PQ: update
* TEST-PQ: also enable sntrup761x25519-sha512 at openssh.com
* TEST-PQ, alg_lists, openssl: enable more experimental `sign` values
* TEST-PQ, python: add more groups, mark experimental
* openssl: mark liboqsprovider groups optional with ?
- Update to version 20240201.9f501f3:
* .gitlab-ci.yml: install sequoia-policy-config
* java: disable ChaCha20-Poly1305 where applicable
* fips-mode-setup: make sure ostree is detected in chroot
* fips-finish-install: make sure ostree is detected in chroot
* TEST-PQ: enable X25519-KYBER768 / P384-KYBER768 for openssl
* TEST-PQ: add a no-op subpolicy
* update-crypto-policies: Keep mid-sentence upper case
* fips-mode-setup: Write error messages to stderr
* fips-mode-setup: Fix some shellcheck warnings
* fips-mode-setup: Fix test for empty /boot
* fips-mode-setup: Avoid 'boot=UUID=' if /boot == /
* Update man pages
- Update to version 20231108.adb5572b:
* Print matches in syntax deprecation warnings
* Restore support for scoped ssh_etm directives
* fips-mode-setup: Fix usage with --no-bootcfg
* turn ssh_etm into an etm at SSH tri-state
* fips-mode-setup: increase chroot-friendliness
* bind: fix a typo that led to duplication of ECDSAPxxxSHAxxx
* pylintrc: use-implicit-booleaness-not-comparison-to-*
- avoid the cycle rpm/cmake/crypto-policies/python-rpm-macros:
we only need python3-base here, we don't need the python
macros as no module is being built
- Remove dependency on /usr/bin/python3, making scripts to depends on
the real python3 binary, not the link. bsc#1212476
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4114-1
Released: Wed Sep 9 18:20:02 2026
Summary: Security update for tomcat11
Type: security
Severity: important
References: 1273150,1276893,1276894,1276895,1276896,1276897,1276898,1276899,1276900,1276901,1276902,CVE-2026-65182,CVE-2026-65183,CVE-2026-65637,CVE-2026-65905,CVE-2026-65927,CVE-2026-66299,CVE-2026-66422,CVE-2026-68525,CVE-2026-68569,CVE-2026-68763,CVE-2026-73180
This update for tomcat11 fixes the following issues:
- CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint (bsc#1276893).
- CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (bsc#1276894).
- CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete (bsc#1276895).
- CVE-2026-65905: Apache Tomcat: Limited replay attack possible with DIGEST authentication (bsc#1276896).
- CVE-2026-65927: Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
(bsc#1276897).
- CVE-2026-66299: memory exhaustion via maliciously slow clients due to the WebSocket chat example providing an
unbounded buffer for undelivered messages (bsc#1273150).
- CVE-2026-66422: Apache Tomcat: Servlet role references can bypass declarative role constraints (bsc#1276898).
- CVE-2026-68525: Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (bsc#1276899).
- CVE-2026-68569: Apache Tomcat: Principal lookup can fail open in some cases (bsc#1276900).
- CVE-2026-68763: Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
(bsc#1276901).
- CVE-2026-73180: Apache Tomcat: Authenticated WebSocket session survives end of HTTP session (bsc#1276902).
Changes for tomcat11:
- Updated to version 11.0.25
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4118-1
Released: Thu Sep 10 03:04:49 2026
Summary: Recommended update for python-rpm-macros
Type: recommended
Severity: moderate
References:
This update for python-rpm-macros fixes the following issues:
- Provide a primary_python fallback for legacy projects
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4124-1
Released: Thu Sep 10 18:11:41 2026
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1277247
This update for glibc fixes the following issues:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural
optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4127-1
Released: Fri Sep 11 08:49:46 2026
Summary: Recommended update for permissions
Type: recommended
Severity: moderate
References: 1273300,1278351
This update for permissions fixes the following issue:
- Update to version 20250826:
* profiles: backport nvidia-modprobe (bsc#1278351)
* profiles: add cacti-spine cap_net_raw (bsc#1273300)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4136-1
Released: Mon Sep 14 08:01:27 2026
Summary: Recommended update for sg3_utils
Type: recommended
Severity: moderate
References: 1277106
This update for sg3_utils fixes the following issues:
- sg_inq: avoid including 0-bytes in SCSI name strings (bsc#1277106)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4156-1
Released: Mon Sep 14 11:06:43 2026
Summary: Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen
Type: security
Severity: important
References: 1226112,1262698,1262701,1266262,1266263,1271649,1272772,1272773,1272774,1273243,1274867,1278001,1279863,CVE-2026-16349,CVE-2026-16350,CVE-2026-16351,CVE-2026-16352,CVE-2026-16353,CVE-2026-16354,CVE-2026-16355,CVE-2026-16356,CVE-2026-16357,CVE-2026-16358,CVE-2026-16359,CVE-2026-16360,CVE-2026-16362,CVE-2026-16363,CVE-2026-16364,CVE-2026-16365,CVE-2026-16366,CVE-2026-16367,CVE-2026-16368,CVE-2026-16369,CVE-2026-16370,CVE-2026-16371,CVE-2026-16372,CVE-2026-16373,CVE-2026-16374,CVE-2026-16375,CVE-2026-16376,CVE-2026-16377,CVE-2026-16378,CVE-2026-16379,CVE-2026-16380,CVE-2026-16381,CVE-2026-16382,CVE-2026-16383,CVE-2026-16384,CVE-2026-16385,CVE-2026-16386,CVE-2026-16387,CVE-2026-16388,CVE-2026-16389,CVE-2026-16390,CVE-2026-16391,CVE-2026-16392,CVE-2026-16393,CVE-2026-16394,CVE-2026-16395,CVE-2026-16396,CVE-2026-16397,CVE-2026-16398,CVE-2026-16399,CVE-2026-16400,CVE-2026-16401,CVE-2026-16402,CVE-2026-16403,CVE-2026-16404,CVE-2026-16405,CVE-2026-16406,CVE-2026-16407,CVE-2026-16
408,CVE-2026-16409,CVE-2026-16410,CVE-2026-16411,CVE-2026-16412,CVE-2026-74934,CVE-2026-74935,CVE-2026-74936,CVE-2026-74937,CVE-2026-74938,CVE-2026-74939,CVE-2026-74940,CVE-2026-74941,CVE-2026-74942,CVE-2026-74943,CVE-2026-74944,CVE-2026-74945,CVE-2026-74946,CVE-2026-74947,CVE-2026-74948,CVE-2026-74949,CVE-2026-74950,CVE-2026-74952,CVE-2026-74953,CVE-2026-74954,CVE-2026-74955,CVE-2026-74956,CVE-2026-74957,CVE-2026-74958,CVE-2026-74959,CVE-2026-74960,CVE-2026-74961,CVE-2026-74962,CVE-2026-74963,CVE-2026-74964,CVE-2026-74965,CVE-2026-74966,CVE-2026-74967,CVE-2026-74968,CVE-2026-74969,CVE-2026-74970,CVE-2026-74971,CVE-2026-74972,CVE-2026-74973,CVE-2026-74974,CVE-2026-74976,CVE-2026-74977,CVE-2026-74978,CVE-2026-74979,CVE-2026-74981,CVE-2026-74982,CVE-2026-74983,CVE-2026-74984,CVE-2026-74985,CVE-2026-74986,CVE-2026-74987,CVE-2026-74988,CVE-2026-74990,CVE-2026-75874,CVE-2026-84118,CVE-2026-84119,CVE-2026-84120,CVE-2026-84121,CVE-2026-84122,CVE-2026-84123,CVE-2026-84124,CVE-2026-84125,CVE
-2026-84129,CVE-2026-84130,CVE-2026-84131,CVE-2026-84132,CVE-2026-84133,CVE-2026-84134,CVE-2026-84136,CVE-2026-84137,CVE-2026-84139,CVE-2026-84140,CVE-2026-84141,CVE-2026-84143,CVE-2026-84144,CVE-2026-84145
This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:
Changes in MozillaFirefox:
Firefox Extended Support Release 153.2.0 ESR
* Fixed: Various security fixes.
MFSA 2026-85 (bsc#1278001):
* CVE-2026-75874: Sandbox escape in the Remote Settings Client component
* CVE-2026-84118: Use-after-free in the JavaScript: GC component
* CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation
component
* CVE-2026-84120: Use-after-free in the Audio/Video component
* CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security
component
* CVE-2026-84122: Use-after-free in the Audio/Video component
* CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics:
WebGPU component
* CVE-2026-84124: Use-after-free in the DOM: Core & HTML component
* CVE-2026-84125: Use-after-free in the DOM: Core & HTML component
* CVE-2026-74952: Privilege escalation in the Application Update component
* CVE-2026-84129: Site isolation issue in the DOM: Navigation component
* CVE-2026-84130: Information disclosure in the Graphics: WebGPU component
* CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics
component
* CVE-2026-84132: Information disclosure in the Networking: HTTP component
* CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component
* CVE-2026-84134: Other issue in the Profile Backup component
* CVE-2026-84136: Other issue in the DOM: Navigation component
* CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component
* CVE-2026-84139: Clickjacking issue in the DOM: Events component
* CVE-2026-84140: Site isolation issue in the DOM: Navigation component
* CVE-2026-84141: Integer overflow in the Graphics: ImageLib component
* CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2
and Firefox ESR 140.15
* CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR
153.2
* CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR
153.2, Firefox ESR 140.15 and Firefox ESR 115.40
* Fixed: Various security fixes.
MFSA 2026-77 (bsc#1274867):
* CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935: Privilege escalation in the DOM: Networking component
* CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74937: Use-after-free in the JavaScript: GC component
* CVE-2026-74938: Mitigation bypass in the JavaScript: GC component
* CVE-2026-74939: Privilege escalation in the DOM: Navigation component
* CVE-2026-74940: Use-after-free in the Graphics: Text component
* CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942: Privilege escalation in the Remote Settings Client component
* CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
* CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
* CVE-2026-74945: Information disclosure in the Graphics: Text component
* CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component
* CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics
component
* CVE-2026-74948: Information disclosure in the Graphics component
* CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
* CVE-2026-74950: Privilege escalation in the Downloads API component
* CVE-2026-74953: Privilege escalation in the Networking: Cookies component
* CVE-2026-74954: Information disclosure due to side-channel in the Storage:
Cache API component
* CVE-2026-74955: Privilege escalation in the Request Handling component
* CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers
component
* CVE-2026-74957: Mitigation bypass in the Safe Browsing component
* CVE-2026-74958: Information disclosure in the WebRTC component
* CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
* CVE-2026-74960: Site isolation issue in the WebExtensions component
* CVE-2026-74961: Side-channel in the Web Audio component
* CVE-2026-74962: Site isolation issue in the Networking: Cookies component
* CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies
component
* CVE-2026-74964: Integer overflow in the Graphics component
* CVE-2026-74965: Privilege escalation in the Shell Integration component
* CVE-2026-74966: Information disclosure in the Form Autofill component
* CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback
component
* CVE-2026-74968: Site isolation issue in the Graphics: WebRender component
* CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
* CVE-2026-74970: Site isolation issue in the Graphics component
* CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling
component
* CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions
component
* CVE-2026-74973: Race condition, use-after-free in the Graphics component
* CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component
* CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-74977: Integer overflow in the Graphics component
* CVE-2026-74978: Clickjacking issue in the Widget component
* CVE-2026-74979: Mitigation bypass in the Add-ons Manager component
* CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component
* CVE-2026-74982: Denial-of-service in the Widget component
* CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component
* CVE-2026-74984: Race condition in the JavaScript Engine component
* CVE-2026-74985: Privilege escalation in the Enterprise Policies component
* CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation
component
* CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox
ESR 153.1 and Firefox 154
* CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox
154
* CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox
ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Firefox Extended Support Release 153.0esr ESR
* New: ## General
- Firefox now includes a new profile management system that
helps you separate your online life into distinct profiles
for work, school, vacation planning, or whatever you choose.
Profiles can be customized with names, avatars, and color
themes while keeping tabs, bookmarks, passwords, and browsing
history separate. Built-in profile backup and restore also
makes it easier to migrate to a new device or recover your
browsing data.
- Split View lets you view two webpages side-by-side in a
single browser window, with additional options to quickly
open links in Split View, rearrange pages, and search open
tabs.
- The Firefox address bar has gained several new
capabilities, including built-in unit and time zone
conversion, quick actions such as muting all browser audio,
and direct search results as you type.
- Firefox now supports copying links directly to highlighted
text on a webpage for easier sharing.
- Firefox Settings has been redesigned with improved
organization and navigation, making it easier to find and
customize browser preferences.
* New: ## AI
Firefox introduced several new AI-powered features, including
on-device tab organization, AI-assisted link previews,
integrated AI search, and centralized controls for managing
AI features. Whenever possible, these features perform
processing locally to help protect user privacy.
* New: ## Sidebar and Tabs
- Firefox continues to improve tab management with
enhancements to vertical tabs, tab groups, and the sidebar.
- Tab groups have gained numerous usability improvements,
including better support for collapsed groups, previews of
grouped tabs, and additional organization options.
- Passwords can now be accessed directly from the Firefox
sidebar without opening a separate tab.
- Firefox now supports copying links from one or multiple
background tabs directly from the tab context menu, and
multiple tabs can be copied or shared in a single action.
- A Send Tab toolbar button is now available through
Customize Toolbar.
* New: ## Security & Privacy
- Firefox has significantly expanded Fingerprinting
Protection, making it harder for websites to uniquely
identify users in both Standard and Strict Enhanced Tracking
Protection modes.
- Enhanced Tracking Protection includes stronger protections
against bounce tracking and additional safeguards that
restrict websites from accessing local network resources
without user permission.
- Firefox now uses Safe Browsing V5 for phishing and malware
protection.
- Firefox Password Manager now uses stronger AES-256
encryption to protect stored logins on disk.
- Private Browsing has been enhanced with new controls,
including the ability to instantly end a private browsing
session and temporarily relax tracker blocking for individual
sites when needed for compatibility.
* New: ## Translations
- Firefox has expanded on-device translation support with
many additional languages and continued improvements to
translation quality.
- A dedicated translations page now provides an easy way to
perform real-time translations directly within Firefox.
* New: ## Accessibility
- Firefox continues to improve accessibility with enhanced
support for assistive technologies, including Windows UI
Automation, improved keyboard navigation, more accessible
date and time controls, and better support for mathematical
content in PDFs.
* New: ## Windows
- Firefox now supports installing websites as standalone web
apps pinned to the Windows taskbar.
- Firefox web apps are also available for Microsoft Store
installations.
- Firefox now better integrates with Windows location
permissions when websites request geolocation access.
* New: ## macOS
- Firefox now uses a dedicated GPU process by default,
improving stability by allowing graphics failures to recover
without restarting the browser.
- WebGPU is now enabled by default on Apple Silicon Macs.
* New: ## Linux
- Firefox now supports native fractional scaling on Wayland,
improving rendering on high-DPI displays.
- Firefox no longer requires a restart after package manager
updates and uses less memory on Linux.
- Firefox now supports the XDG Base Directory Specification
and ships with RPM packages for Red Hat, Fedora, openSUSE,
and other RPM-based distributions.
* HTML5: - Firefox now supports the View Transitions API for
creating smooth animated transitions between application
views.
- WebGPU support has expanded across supported platforms,
including Windows and Apple Silicon Macs.
- Added support for several modern web platform APIs,
improving compatibility with modern web applications. Notable
additions include the Navigation API, URLPattern, Trusted
Types, Sanitizer API, and Prioritized Task Scheduling.
* Enterprise: - Enterprise administrators can now centrally
manage Firefox's Generative AI features through enterprise
policy.
- Fixed a performance regression affecting native messaging,
improving responsiveness for enterprise extensions that
communicate with external applications.
- Enterprise policy documentation has moved to
https://firefox-admin-docs.mozilla.org/.
* Fixed: Various security fixes.
MFSA 2026-68 (bsc#1271649):
* CVE-2026-16349:
Same-origin policy bypass in the DOM: Navigation component
* CVE-2026-16350:
Incorrect boundary conditions in the Audio/Video: cubeb
component
* CVE-2026-16362:
Use-after-free in the WebRTC: Audio/Video component
* CVE-2026-16351:
Sandbox escape due to use-after-free in the DOM: Navigation
component
* CVE-2026-16352:
Sandbox escape due to use-after-free in the Disability Access
APIs component
* CVE-2026-16363:
JIT miscompilation in the JavaScript: WebAssembly component
* CVE-2026-16364:
Incorrect boundary conditions in the Audio/Video: Playback
component
* CVE-2026-16365:
Privilege escalation in the DOM: Workers component
* CVE-2026-16366:
Privilege escalation in the DOM: Navigation component
* CVE-2026-16353:
Invalid pointer in the DOM: Bindings (WebIDL) component
* CVE-2026-16354:
Information disclosure in the Graphics: ImageLib component
* CVE-2026-16367:
Sandbox escape due to invalid pointer in the Disability
Access APIs component
* CVE-2026-16368:
Incorrect boundary conditions in the JavaScript: WebAssembly
component
* CVE-2026-16369:
Integer overflow in the JavaScript: WebAssembly component
* CVE-2026-16355:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16356:
Sandbox escape due to use-after-free in the Disability Access
APIs component
* CVE-2026-16357:
Incorrect boundary conditions in the Graphics component
* CVE-2026-16370:
Mitigation bypass in the DOM: Networking component
* CVE-2026-16371:
Privilege escalation in the DOM: Navigation component
* CVE-2026-16372:
Privilege escalation in the DOM: Content Processes component
* CVE-2026-16373:
Information disclosure in the Privacy component in Firefox
for Android
* CVE-2026-16374:
Information disclosure in the Framework component in DevTools
* CVE-2026-16375:
Site isolation issue in the Networking: HTTP component
* CVE-2026-16376:
Denial-of-service in the Graphics: WebGPU component
* CVE-2026-16377:
Mitigation bypass in the PDF Viewer component
* CVE-2026-16378:
Other issue in the DOM: Copy & Paste and Drag & Drop
component
* CVE-2026-16379:
Privilege escalation in the DOM: Content Processes component
* CVE-2026-16358:
Site isolation issue in the Graphics: WebRender component
* CVE-2026-16380:
Mitigation bypass in the Networking component
* CVE-2026-16381:
Same-origin policy bypass in the Networking: DNS component
* CVE-2026-16382:
Mitigation bypass in the DOM: Service Workers component
* CVE-2026-16383:
Mitigation bypass in the DOM: Networking component
* CVE-2026-16384:
Information disclosure due to uninitialized memory in the
Graphics: WebGPU component
* CVE-2026-16385:
Information disclosure due to uninitialized memory in the
Graphics: WebGPU component
* CVE-2026-16386:
Information disclosure due to uninitialized memory in the
Graphics: WebGPU component
* CVE-2026-16387:
Site isolation issue in the Networking component
* CVE-2026-16388:
Sandbox escape in the DOM: Networking component
* CVE-2026-16389:
Incorrect boundary conditions, integer overflow in the
Libraries component in NSS
* CVE-2026-16390:
Mitigation bypass in the Enterprise Policies component
* CVE-2026-16391:
Information disclosure in the Storage: IndexedDB component
* CVE-2026-16392:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16393:
Incorrect boundary conditions in the Graphics: WebGPU
component
* CVE-2026-16359:
Incorrect boundary conditions in the Audio/Video: GMP
component
* CVE-2026-16394:
Mitigation bypass in the DOM: Security component
* CVE-2026-16395:
Integer overflow in the Audio/Video component
* CVE-2026-16396:
Privilege escalation in WebExtensions
* CVE-2026-16397:
Clickjacking issue in the WebExtensions component in Firefox
for Android
* CVE-2026-16398:
Site isolation issue in the Graphics component
* CVE-2026-16399:
Site isolation issue in the DOM: Navigation component
* CVE-2026-16400:
Information disclosure in the DOM: Security component
* CVE-2026-16401:
Privilege escalation in the Data Loss Prevention component
* CVE-2026-16402:
Integer overflow in the Graphics: ImageLib component
* CVE-2026-16403:
Spoofing issue in the Address Bar component
* CVE-2026-16404:
Spoofing issue in Firefox for Android
* CVE-2026-16405:
Information disclosure in the Networking: WebSockets
component
* CVE-2026-16406:
Mitigation bypass in the Networking component
* CVE-2026-16407:
Mitigation bypass in the DOM: Service Workers component
* CVE-2026-16408:
Integer overflow in the Audio/Video: Playback component
* CVE-2026-16409:
Invalid pointer in the Security: PSM component
* CVE-2026-16410:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16411:
Memory safety bugs fixed in Firefox 153
* CVE-2026-16412:
Memory safety bugs fixed in Firefox ESR 140.13 and Firefox
153
* CVE-2026-16360:
Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR
140.13 and Firefox 153
* Fixed: Various security fixes.
MFSA 2026-76 (bsc#1274867):
* CVE-2026-74934:
Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935:
Privilege escalation in the DOM: Networking component
* CVE-2026-74936:
Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74939:
Privilege escalation in the DOM: Navigation component
* CVE-2026-74940:
Use-after-free in the Graphics: Text component
* CVE-2026-74941:
Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942:
Privilege escalation in the Remote Settings Client component
* CVE-2026-74943:
Use-after-free in the Graphics: ImageLib component
* CVE-2026-74944:
Use-after-free in the DOM: Core & HTML component
* CVE-2026-74945:
Information disclosure in the Graphics: Text component
* CVE-2026-74946:
Privilege escalation due to incorrect boundary conditions in
the Graphics: CanvasWebGL component
* CVE-2026-74948:
Information disclosure in the Graphics component
* CVE-2026-74949:
Privilege escalation due to use-after-free in the Graphics:
Canvas2D component
* CVE-2026-74953:
Privilege escalation in the Networking: Cookies component
* CVE-2026-74957:
Mitigation bypass in the Safe Browsing component
* CVE-2026-74959:
Mitigation bypass in the Storage: Cache API component
* CVE-2026-74960:
Site isolation issue in the WebExtensions component
* CVE-2026-74962:
Site isolation issue in the Networking: Cookies component
* CVE-2026-74963:
Same-origin policy bypass in the Networking: Cookies
component
* CVE-2026-74964:
Integer overflow in the Graphics component
* CVE-2026-74965:
Privilege escalation in the Shell Integration component
* CVE-2026-74967:
Same-origin policy bypass in the Audio/Video: Playback
component
* CVE-2026-74969:
Use-after-free in the Layout: Text and Fonts component
* CVE-2026-74971:
Information disclosure in the DOM: UI Events & Focus Handling
component
* CVE-2026-74972:
Information disclosure in the DOM: Push Subscriptions
component
* CVE-2026-74973:
Race condition, use-after-free in the Graphics component
* CVE-2026-74974:
Same-origin policy bypass in the Graphics: ImageLib component
* CVE-2026-74976:
JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-74983:
Mitigation bypass in the Data Loss Prevention component
* CVE-2026-74987:
Internally found bugs fixed in Firefox ESR 140.14, Firefox
ESR 153.1 and Firefox 154
* CVE-2026-74990:
Internally found bugs fixed in Firefox ESR 115.39, Firefox
ESR 140.14, Firefox ESR 153.1 and Firefox 154
Changes in rust-cbindgen:
- Update to version v0.29.4+git0:
* Bump version.
* tests: Add some tests for constant enums.
* ir: Add support for arrays.
* ir: Allow constant literals with enum variants.
* ir: Use Path for ConstExprs.
* Bump version to 0.29.3 and update CHANGES doc
* tests: Fix tests with modern gcc.
* Use C++ fixed-type enumeration syntax under C23 (or higher) as well
* Allow `pub` access to `ReprType` fields
- Update to version 0.29.2+git0:
* ci: Add a meta job to block the merge queue on it.
* Check for CMSE ABI's as well
* Fix doc attribute parsing to properly handle block comments
* Expose the line_endings config option to use with the builder
* fix env in workflow file
* use env to pass output parameters
* Explicitly request serde's std features to avoid issues with newer toml versions.
* Account for master -> main rename.
* Update changelog and bump version.
* enum: Track dependencies properly in enumerations.
- Update to version 0.29.2+git0:
* Explicitly request serde's std features to avoid issues with newer toml versions.
* Account for master -> main rename.
* Update changelog and bump version.
* enum: Track dependencies properly in enumerations.
* Allow must_use if a reason is specified
* constant: Handle cfg in associated constants.
* tests: Add a test for bitflags + disjoint cfg.
* Remove 'display' feature from the toml crate
* DOC: Add metatensor
* Fix #1085 - Incorrect detection of duplicated constants
* chore: More clippy fixes.
* docs: Correct after_include type in example config
* cargo update
* cfg: Remove another clippy warning.
* Fix `clippy::uninlined_format_args`
* Update toml to 0.9
* Release 0.29.0
* Support no-export annotation for statics and functions.
* conditional fields of constexpr literal structs
* Add LiteralStructField
* Github action: Add aarch64 to deploy
* Add rename rule for generated associated constant
* Upgrade heck to 0.5
* Add support for an optional nullable attribute
* docs.md: Fix deprecated_with_note and deprecated_variant_with_note being spelled as 'notes'
* Fix generic with 'void' default
* The return of Cast is simplified
* Added tests for as keyword inside array into structs
* Fixed error generation of structures using the keyword of as inside arrays
* Added test for unsafe(no_mangle) attribute
* Added tests for unsafe methotd's atributs
* Fixed handling of trait methods containing the unsafe attribute
* Rename -Zparse-only
* Release 0.28.0
* tests: Fix symbol file and tests.
* Appease clippy.
* tests: Run rustfmt.
Changes in mozilla-nspr:
- update to NSPR 4.39
* Improved error handling in PR_CreateThread on Windows
* Cleanup and Type-cast fixes for prtime
* Remove unused prstreams C++ wrapper from NSPR
* Memory poisoning and Arena redzone fixes
* Removed emacs/vim modelines and .cvsignore files
* Added .editorconfig
- update to version 4.38.2
* Fixed a syntax error in test file parsetm.c, which was
introduced in 4.38.1
- update to version 4.38.1
* Incorrect time value produced by PR_ParseTimeString and
PR_ParseTimeStringToExplodedTime if input string doesn't
specify seconds.
- update to version 4.38
* Removed support for HPUX and _PR_POLL_WITH_SELECT
* Fixed a bug in pt_TCP_SendTo on macOS
* Ensure parameter passed to isalpha() is unsigned char
- update to version 4.37
* PR_GetUniqueIdentity asserts on the 32767th call
* error LNK2019: unresolved external
symbol _InterlockedCompareExchange
* initclk deadline elapsed macOS
* Remove prwin.h (formerly known as prwin16.h)
* Use builtin atomic functions on RISC-V32/64
* PR_FormatTimeUSEnglish() doesn't support '%e'
format specifier
Changes in MozillaFirefox-branding-SLE:
- use suse_version for SLE16 (bsc#1273243)
- chage version to 153
- Switch to using xdg-desktop-portal file picker everywhere
for SLE-16 and later (bsc#1226112)
Changes in mozilla-nss:
- Fix potential crash in FIPS checks on PBKDF2 password checking (boo#1279863)
- Fix upper bound to allow FIPS approval for P-521.
- Approve HKDF and key concatenation in the context of TLS. This enables approved TLS
1.3 channels with PQC (bsc#1262698).
- Don't consider unapproved algorithms for TLS 1.3 in FIPS mode.
- Mark TLS 1.2 KDF without extended master secret non-approved for FIPS (bsc#1266262).
- Add patch to prefer any hybrid PQC and send at most one hybrid key share
(bsc#1262698).
- Add a notice to the module ID when it's in non-FIPS mode (bsc#1266263).
- Import ML-DSA implementation and related PQC fixes from upstream (bsc#1262698, bsc#1272772).
- Add power-on self-tests (KATs) for ML-KEM and ML-DSA (bsc#1272773).
- Add zeroization for ML-KEM, ported from upstream (bsc#1272774).
- Add zeroization for ML-DSA (bsc#1272774).
- nss-ml-dsa-test-fixes.patch: Add ML-DSA robustness and test fixes.
- Add PQC algorithms to approved list. Increase approved symmetric keygen floor to 112
bits (bsc#1262698). Approve non-NSS-aliased TLS 1.2 mechanisms
(bsc#1266262).
- Apply jitter enablement unconditionally (bsc#1262701).
- update to NSS 3.125
* Set nssckbi version to 2.88.
* Add Cybertrust Japan SecureSign Root CA16.
* Remove Email Trust bit from TrustAsia Global Root CA G3 and G4.
* Remove Entrust Root Certification Authority.
* Remove SecureSign Root CA12.
* Initialize ssl3.hs.echOuterExtensions in ssl_NewSocket.
* replace references to nss-dev/nss with mozilla/nss.
* limit recursion depth in CMS decoder.
* clamp input.len to testString size in pk11_mergeSecretKey.
* NULL pointer dereference in CERT_MergeExtensions.
* CERT_DecodeAVAValue — Integer Overflow in Output Buffer Sizing.
* fix two integer overflows on LLP64 systems.
* Modify an assertion in ssl3_ClientSendAppProtoXtn.
* Import RSA-PSS PKCS#8 private keys.
* Add EC Derive fuzz target.
* Update fuzz/config/tstclnt_arguments.py.
* Add DSAU fuzz target.
* Update ASN1 mutators for fuzzing.
* Update TLS mutators for fuzzing.
* Update TLS certs for fuzzing.
* Update TLS config for fuzzing.
* Extend QuickDER fuzz target.
* Extend PKCS12 fuzz target.
* Extend PKCS8 fuzz target.
* Extend certDN fuzz target.
* Update ASN1 fuzz target.
* Extend PKCS7 fuzz target.
* Bounds-check wrap index in PK11_GetWrapKey to match PK11_SetWrapKey.
* Adding a guard against integer overflow in AESKeyWrap_EncryptKWP.
* Add an integer overflow guard in UpdateBase64Decoder.
* Void out the fd.release in reconfig tests.
* make sftk_FindAttribute return a copy.
* Converted nss parameter schema from voluptuous to msgspec.
* bmo#311577 - drop slot monitor in PK11_ResetToken before calling PK11_InitToken.
* adjust the code to use nspr from github.
* avoid deadlock when PK11_IsLoggedIn is called from PK11_DoPassword.
* test pk11auth.c functions with a non-threadsafe module.
* bmo#311577 - PK11_InitPin sets slot->lastLoginCheck without holding the slot monitor.
* reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
* validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen.
* guard space subtraction in ssl_CallCustomExtensionSenders.
* rewrite labelLen bound in tls13_HkdfExpandLabelGeneral to avoid unsigned overflow.
* bound usageCount in PK11_UnwrapPrivKey to keyTemplate capacity.
* Set tail pointer to null in static slot lists when deallocating.
* avoid leaving a dangling ss->sec.ci.sid on allocation failure.
* guard against integer overflow in CERT_Hexify.
* Reject empty SECItem inputs in sftk_IsSafePrime before indexing data[len-1].
* NUL-terminate within filename field in jar_listtar to bound the filename scan.
* Widen CERT_FormatName length accumulator from unsigned to size_t.
* Bound IKE PRF nonce lengths to prevent CK_ULONG to unsigned int truncation.
* Drop companion arrays on length mismatch in NSS_CMSArray_Sort instead of asserting.
* Operate on a NUL-terminated copy in jar_parse_any to keep manifest scans bounded.
* Reject MD2 contexts with unusedBuffer > MD2_BUFSIZE in Update and End.
* Reserve NUL terminator for CKA_NSS_URL in nssCKObject_GetAttributes.
* Guard padding read against empty output in SEC_PKCS7DecryptContents.
* Guard against keySize overflow in IKE PRF/PRF+ output sizing.
* Allocate values array when overwriting an empty CMS attribute.
* Validate CKA_TOKEN attribute size in nssCKFWObject_SetAttribute.
* Validate CKA_CERTIFICATE_TYPE ulValueLen in nss_cert_type_from_ck_attrib.
* Handle zero-length input in PrepareBitStringForEncoding.
* Length-check raw_manifest before PORT_Strncasecmp prefix dispatch in JAR_parse_manifest.
* Reject CKA_NSS_MODULE_SPEC values that aren’t NUL-terminated within ulValueLen.
* Reject negative PR_Read returns in JAR_digest_file and jar_create_pk7.
* Update Bogo tests to 3fff7111b0eca817466e121059cb4e8b67ade35b.
* doc: import NSS:TryServer wiki page in the tree.
* improve PK11 URI tests.
* avoid nested attributeLock acquisition in sftk_CopyObject.
* doc: fix a typo in “Community — Network Security Services (NSS)â€.
* acquire RWLock before key copies in ssl_SetSelfEncryptKeyPair.
* Reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
* require non-null session pointer in sftk_GetContext.
* set session->lastOpWasFIPS while holding session reference.
* atomically claim object removal in sftk_DeleteObject.
* atomically swap session search in NSC_FindObjects*.
* atomically install session contexts in C_*Init.
* hold session reference for context lifetime in C_*Update.
* align softoken session lock with head-bucket hash.
* restore reference counting for SFTKSession.
- update to NSS 3.124
* Add test for PKCS7 digest array alignment
* Add test for rejection of excessively large ASN.1 SEQUENCE OF in quickder
* Add test for CMS content size validation
* Add regression tests for DSAU signature decoding
* Add test for S/MIME profile lookup on temp certs
* Test case for post-handshake auth and many certificate requests
* Add test for intra-arena ASan redzones
* update nss_status flags one at a time
* add defensive info->len check in PK11_HPKE_SetupS and PK11_HPKE_SetupR
* avoid PORT_Strdup in ssl_DecodeResumptionToken
* add runtime check on decoded resumption token session id
* improve mach try error handling
* clang format
* add comprehensive SECItem and SECItemArray tests
* add bugzilla_cf_status_nss.py script
* regenerate some recent release notes
* fix bug list output by release note and email scripts
* test removal from trust domain email cache
* fix 'testing if key corruption is detected in attribute' failures with sqlite-3.53.0
* build sqlite3 shell for Windows CI runners
* avoid race with module unloading in NSSTrustDomain_FindTokensByURI
* add ImportEd25519WithNonEmptyAlgorithmParams test
* add CLAUDE.md and .mcp.json
* add a mach try command
* remove dead condition in sec_asn1d_check_and_subtract_length
* avoid integer truncation in nssCKObject_GetAttributes
* add defensive input validation to sftk_compute_ANSI_X9_63_kdf
* avoid refcount over-release in nssTokenObjectCache error path [@ nssToken_Destroy]
* sdb: enforce that metaData's id key is unique when reading
* improve handling of escape sequences in pk11uri_ParseAttributes
* use correct data for ID comparison in transfer_uri_certs_to_collection
* fix truncation of ulValueLen in sdb_FindObjectsInit
* reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max
* set previous-nss-release for abicheck
* Skip `PR_Sleep` yield for non-blocking sockets in `ssl3_SendApplicationData`
* consistently protect PK11SlotInfo::maxKeyCount with freeListLock
* Remove CRMF from testing and manifests
* Remove unused RSA blind signature implementation from freebl
- update to NSS 3.123.1
* reject DTLS 1.3 Server Hello after HVR without
capping ss->vrange.max
- update to NSS 3.123
* https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/AW6VHkn6E0o
- update to NSS 3.122.2:
* reject DTLS 1.3 Server Hello after HVR without
capping ss->vrange.max
- update to NSS 3.122.1
* improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
* Improving the allocation of S/MIME DecryptSymKey.
* store email on subject cache_entry in NSS trust domain.
* Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
* Improve size calculations in CMS content buffering.
* avoid integer overflow while escaping RFC822 Names.
* Reject excessively large ASN.1 SEQUENCE OF in quickder.
* Deep copy profile data in CERT_FindSMimeProfile.
* Improve input validation in DSAU signature decoding.
* avoid integer overflow in RSA_EMSAEncodePSS.
* Add a maximum cert uncompressed len and tests.
* Clarify extension negotiation mechanism for TLS Handshakes.
* make ss->ssl3.hs.cookie an owned-copy of the cookie.
- update to NSS 3.122
* ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
* run mach doc-lint from generate_release_doc.py.
* Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
* tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
* fix cipher spec count intermittent CI failures.
* fix Mlkem768x25519ShareDamager intermittent CI failures.
* lint the legacy documentation.
* lint the NSS 3.112.3 release notes.
* add a doc-lint CI job.
* Add more useful coverage reports to CI and fail if new commit isn't tested.
* wrong alert for malformed TLS 1.3 Finished.
* Swap order of asserts and state check.
* set correct value of unused curve parameters in tls13_HandleKeyShare.
* GCM needs to check for various limits in FIPS mode.
* Get Key Length not working from ED and Montgomery keys.
* Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
* fix intermittent ssl.sh test failures on windows runners.
* FIPS indicators on HKDF needs to be restricted to TLS usage.
* Generate keys not getting indicators.
* improve error handling in smime_init_once.
* Detect CPU features on OpenBSD using elf_aux_info.
* RSA_EMSAEncodePSS should validate the length of mHash.
* more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
* fix missing .S file error in Solaris Makefile builds.
* fix memory leak in NSC_GenerateKey error path.
* Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
* release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
* release 1stHandshakeLock on SSL_ResetHandshake error path.
* avoid null deref in mp_div_d sign normalization.
* Temp private key lifecycle is broken.
* protect rwSessionCount with slotLock.
* Remove invalid PORT_Free().
* Fix intermittent ClientGreaseKeyShare test failure.
* Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
* patch upstream acvp-rust during checkout to avoid build failures.
* update acvp Dockerfile.
* CKA_PARAM_SET missing from the CK_ULONG list in softoken.
* CKA_SEED missing from isPrivate in the database.
* update abicheck expectation for __nss_InitLock.
* taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
* tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
* tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
* tests: add native_path helper for cross-platform path conversion.
* tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
* avoid platform GCM for x64 iOS emulator builds.
* remove lock instrumentation feature.
* Move FIPS indicator structures out of fips_algorithms.h.
* all.sh is failing in FIPS SSL test in main tree.
* fix memory leaks in crmf tests.
* fix unsatisfiable condition in lg_getTrust.
* allow selfserv makefile build to use system zlib.
* Add allocation limit to pkcs12 decoding.
* Add text/html single-line example emails to NSS S/SMIME CMS tests.
- Rebase patches nss-fips-aes-gcm-restrict.patch and nss-fips-approved-crypto-non-ec.patch
due to upstreamed FIPS patches
- update to NSS 3.121
* update vendored zlib to v1.3.2.
* Revert the unnecessary changes to intel-gcm-wrap.gyp.
* Use C fallback for AES-GCM on MinGW builds.
* fix ML-KEM PCT.
* Extend NSS Fuzzing docs.
* avoid integer overflow in platform-independent ghash.
* Fix errant whitespace in OISTE Server Root RSA G1 nickname.
* fix build with glibc-2.43 assignment discards 'const'
qualifier from pointer.
* add gcm.gyp dependency for Solaris SPARC builds.
* Set nssckbi version to 2.84.
* Add e-Szigno TLS Root CA 2023 to NSS.
* allow manual selection of CPU_ARCH=x86_64 and ppc64
in coreconf/Darwin.mk.
* Update cryptofuzz version.
* Paranoia assert.
* Darwin compatibility for intel-aes.S and intel-gcm.S.
* rename intel-{aes,gcm}.s to .S.
* rename C files for platform-specific ghash implementations.
* simplify compilation of platform-specific GCM and GHASH.
* FORWARD_NULL null deref of worker in p7decode.c
(sec_pkcs7_decoder_abort_digests).
* Out-of-Bounds Read in ML-DSA Private Key Parsing
(zero-length privateKey).
- update to NSS 3.120.1
* no upstream releasenotes
- update to NSS 3.120
* Fix docs generation bug.
* CID 1678226: Dereferencing null pointer plaintext.data().
* Run PKCS12 fuzz target with --fuzz=tls in CI.
* Allowing RT be started several times.
* move linux decision and build tasks to d2g worker pools.
- Revert back to original naming scheme of tarballs
- update to NSS 3.119.1
* restore coreconf/Darwin.mk behavior for intel archs
- update to NSS 3.119
* Fix ml-dsa return value for SECKEY_PrivateKeyStrengthInBits.
* Make sure we don't accept ECH if the HRR cookie is ill-formatted.
* Add a pkcs12 fuzzer with crypto stubbed out.
* handle errors while setting sanitizers cflags in build.
* Ignore IVs for AES KW.
* Update Cryptofuzz version.
* Fix incorrect logic for SNI selection when ECH is available but disabled.
* fix forwarding of sqlite_libs in sqlite.gyp.
* fix CPU_ARCH setting for arm64 makefile builds.
* remove unused calcThreads variable from cmd/rsaperf.
* Solving the incorrect tests introduced by extending EKU.
* Memory leaks in pkcs12 and pkcs7 decoders.
* Extending parsing with Microsoft Document Signing EKU.
* Extending parsing with Adobe Document Signing EKU.
* Extending pkix parsing with document signing EKUs.
* fix compilation failure on ia32.
* use hardware x64 GCM in static builds.
* separate ppc sha512 library from ppc gcm library.
* simplify cross-compilation from build.sh.
* use clang's integrated assembler.
* remove unused MP_IS_LITTLE_ENDIAN defines.
* fix logic for disabling altivec in gyp builds.
* free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
* Add TLS interoperability tests with openssl and gnutls.
* Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
* add failure checks to pk11_mergeTrust() .
* pk11wrap selects incorrect slot for CKM_ML_KEM*.
- Adjusted for changed naming scheme of tarballs for this release by upstream
- update to NSS 3.118.1
* pk11wrap selects incorrect slot for CKM_ML_KEM*
- update to NSS 3.118
* Remove four Commscope root certificates from NSS
* fix try pushes with --nspr-patch to actually apply the patch
* Support for NIST Curves compressed points
* Destroy certificate on error paths
* Move NSS DB password hash away from SHA-1
* support secp384r1mlkem1024
* vendor latest ML-KEM code from libcrux
* add mlk-kem-1024 tests
* use the correct directory for FStar_UInt_8_16_32_64.h in source consistency test
* Move scripts to python3
* add mlkem1024 support in freebl
* support secp256r1mlkem768
* Make mlkem768x25519 the default
* ML-DSA SGN and VFY interfaces
* Align FIPS interfaces count with array
* Ensure CKK_ML_KEM has derive CK_FALSE
* Add script for tagging an NSS release
* Remove the globals from nss-release-helper.py
* Add release helper command for generating the release index
* Add release helper command for generating a release note
* Add release helper command for freezing a branch
- update to NSS 3.117
* fix memory leak in secasn1decode_unittest.cc
* Add OISTE roots
* Add runbook for certdata.txt changes
* dbtool: close databases before shutdown
* SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
* don’t flush base64 when buffer is null
* Set use_pkcs5_pbkd2_params2_only=1 for fuzzing builds
* mozilla::pkix: recognize the qcStatements extension for QWACs
* Fix a big-endian-problematic cast in zlib calls
* Revert removing out/ directory after ossfuzz build
* Add Cryptofuzz to OSS-Fuzz build
* Add PKCS#11 trust tests
* final disable dsa patch cert.sh
* ml-dsa: move tls 1.3 to use streaming signatures
* ml-dsa: Prep Create a FindOidTagByString function
* ml-dsa: softoken changes
* ml-dsa: der key decode
* ml-dsa: Prep colapse the overuse of keyType outside of pk11wrap and cryptohi
* ml-dsa: Prep Create a CreateSignatureAlgorithmID function
- update to NSS 3.116
* disable DSA in NSS script tests
* Disabling of some algorithms: generic cert.sh
* Need to update to new mechanisms
* Add ML-DSA public key printing support in NSS command-line utilities
* note embedded scts before revocation checks are performed
* Add support for ML-DSA keys and mechanisms in PKCS#11 interface
* Add support for ML-DSA key type and public key structure
* Enable ML-DSA integration via OIDs support and SECMOD flag
* disable kyber
* Implement PKCS #11 v3.2 PQ functions (use verify signature)
* Disable dsa - gtests
* make group and scheme support in test tools generic
* Create GH workflow to automatically close PRs
* Disable dsa - base code
* Disabling of some algorithms: remove dsa from pk11_mode
* Disable seed and RC2 bug fixes
* restore support for finding certificates by decoded serial number
* avoid CKR_BUFFER_TO_SMALL error in trust lookups
* lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type
* Use PKCS #11 v3.2 KEM mechanisms and functions
- update to NSS 3.115.1
* restore support for finding certificates by decoded serial number.
* avoid CKR_BUFFER_TO_SMALL error in trust lookups.
- update to NSS 3.115
* CID 1648399 - Resource leak in shlibsign.c
* CKA_SEED needs to be marked as a private attribute
* Fix bad syntax on Windows in softoken_gtest.cc
* Key private/public/secret keys by key type in softoken keydb
* add PK11_HPKE_GetSharedSecret to abi-check expected report
* remove NetscapeStepUpMatchesServerAuth from mozpkix TrustDomain
* Fixup ABI
* add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server
* ECH fuzz target
* Implement PKCS #11 v3.2 FIPS indicator and validation objects
* remove expired explicitly distrusted DigiNotar lookalike root
* Implement PKCS #11 v3.2 functions
- update to NSS 3.114
* NSS 3.114 source distribution should include NSPR 4.37
* Prevent leaks during pkcs12 decoding
* Remove redundant assert in p7local.c
* Bump nssckbi version to 2.80
* Remove expired Baltimore CyberTrust Root
* Add TrustAsia Dedicated Roots to NSS
* Add SwissSign 2022 Roots to NSS
* Add backwards compatibility for CK_PKCS5_PBKD2_PARAMS
* Implement PKCS #11 v3.2 trust objects in softoken
* Implement PKCS #11 v3.2 trust objects - nss proper
* remove dead code in ssl3con.c
* DTLS (excl DTLS1.3) Changing Holddown timer logic
* Bump nssckbi version to 2.79
* remove unneccessary assertion
* Update mechanisms for Softoken PCT
* convert Chunghwa Telecom ePKI Root removal to a distrust after
* Ensure ssl_HaveRecvBufLock and friends respect opt.noLocks
* use -O2 for asan build
* Fix leaking locks when toggling SSL_NO_LOCKS
* remove out-of-function semicolon
* Extend pkcs8 fuzz target
* Extend pkcs7 fuzz target
* Remove unused assignment to pageno
* Remove unused assignment to nextChunk
* don't run commands as part of shell `local` declarations
* fix sanitizer setup
* don't silence ssl_gtests output when running with coverage
* Release docs and housekeeping
* migrate to new linux tester pool
- rebase FIPS patches to adjust for upstream FIPS work
- update to NSS 3.113
* Fix alias for mac workers on try.
* bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
* Bump nssckbi version to 2.78.
* Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
* fix frame pointers in intel-gcm.s.
* Typo in release notes for NSS 101.4.
* Improve nss-release-helper.py.
* shlibsign is broken in System FIPS mode.
* Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
* PKCS #11 v3.2 header files.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4176-1
Released: Mon Sep 14 12:29:48 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
- update to 2.5.2:
* attr: eliminate a dead store in attr_copy_action()
* libattr: Set symbol versions for legacy syscalls via attribute
or asm
* exports: use LGPL for library code
* documentation updates
* translation updates (Polish, Dutch, Gregorian, French)
* build system updates
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4205-1
Released: Wed Sep 16 10:20:20 2026
Summary: Security update for lcms2
Type: security
Severity: low
References: 1264994,CVE-2026-41254
This update for lcms2 fixes the following issue:
- CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4211-1
Released: Wed Sep 16 13:51:01 2026
Summary: Security update for kbd
Type: security
Severity: important
References: 1275441,CVE-2026-72693
This update for kbd fixes the following issue:
- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows
`passwordless` root login (bsc#1275441).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4241-1
Released: Thu Sep 17 13:48:51 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4250-1
Released: Thu Sep 17 18:00:36 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1267610,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4277-1
Released: Tue Sep 22 10:30:53 2026
Summary: Security update for freeipmi
Type: security
Severity: important
References: 1267605,1278719,1278721,1278722,1278724,1278726,1278727,CVE-2026-50031,CVE-2026-85504,CVE-2026-85505,CVE-2026-85506,CVE-2026-85507,CVE-2026-85508,CVE-2026-85509
This update for freeipmi fixes the following issues:
- CVE-2026-50031: Denial of service via buffer overflow in ipmi-oem client (bsc#1267605).
- CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses (bsc#1278719).
- CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem (bsc#1278722).
- CVE-2026-85506: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (bsc#1278721).
- CVE-2026-85507: stack-based buffer overflow in _output_dell_system_info_cmc_info (bsc#1278724).
- CVE-2026-85508: stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info (bsc#1278726).
- CVE-2026-85509: stack-based buffer overflow when a BMC returns more bytes than requested (bsc#1278727).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4285-1
Released: Tue Sep 22 18:08:23 2026
Summary: Security update for bind
Type: security
Severity: important
References: 1280430,1280432,1280433,1280435,1280436,1280437,1280438,1280439,1280440,1280441,1280442,1280443,1280444,1280445,CVE-2026-19033,CVE-2026-19662,CVE-2026-19666,CVE-2026-19667,CVE-2026-19668,CVE-2026-19941,CVE-2026-75029,CVE-2026-76163,CVE-2026-77119,CVE-2026-77692,CVE-2026-78301,CVE-2026-80274,CVE-2026-81563,CVE-2026-81736
This update for bind fixes the following issues:
- CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
- CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
- CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
- CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
- CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
- CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
- CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
(bsc#1280438).
- CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement
(bsc#1280439).
- CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
- CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
- CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
- CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
- CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
- CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).
Changes for bind:
Upgrade to release 9.20.29
New Features:
* Disclose active Negative Trust Anchors with Extended DNS Error
33.
Feature Changes:
* Reject oversized and malformed DNSKEY records up front.
* Speed up RPZ policy zone updates.
Bug Fixes:
* Prevent a crash when using both dns64 and filter-a.
* Stop passing UDP client addresses to update-policy external
helpers.
* Missing required NSEC3 for delegation not detected.
* Tighten EUI48 and EUI64 text parsing.
* GeoIP ACL state could be stale or wrong after reload.
* Honor DNSSEC policy key tag ranges.
* Fix a double free in mdig when EDNS options are specified.
* Fix a crash when an IXFR falls back to AXFR with updates still
pending.
* Fix DS requests to parental agents over TLS.
* Fix the rndc-confgen -q (quiet) option.
* Enforce query ACLs for redirect zones and searched DLZs.
* Check asnum validity in GeoIP ACLs.
* Fix a crash on remote-servers lists that reference themselves.
* A record from outside a response policy zone could crash named.
* Invalid key-store configuration could abort the DNSSEC tools.
* NSEC signature set could bypass the secure-delegation check.
* Fix a possible nsupdate issue when using GSS-TSIG.
* Fix a crash with a single-element geoip sortlist.
* Prevent out-of-bailiwick CNAMEs from evicting cached records.
* Restore periodic cleanup of stale resolver address data.
* Fix named-checkconf/named crash with malformed key name.
* Prevent resolver crashes while processing DNS over TCP.
* Ensure NSEC authority does not cross zonecut boundary.
* Treat an unusable NSEC3 chain as a verification failure.
* Treat non-canonical RPZ prefixes as any other failure.
* Negative caching stopped working with
stale-answer-client-timeout set to 0.
* An unterminated OpenSSL private-key Label: field could be read
past its parser buffer.
* Restore SMF support on Solaris and illumos.
* Fix compilation on GNU/Hurd.
* dig +yaml was producing invalid YAML when a lookup failed.
* Properly prevent TSIG generation command line injection
attacks.
* Fix a potential heap bounds overflow write in dnssec-signzone.
* Fix crashes on invalid DNSTAP input in dnstap-read.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4367-1
Released: Mon Sep 28 17:01:44 2026
Summary: Security update for glib2
Type: security
Severity: moderate
References: 1272206,CVE-2026-15588
This update for glib2 fixes the following issue:
- CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering (bsc#1272206).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4368-1
Released: Mon Sep 28 17:05:01 2026
Summary: Security update for libsodium
Type: security
Severity: moderate
References: 1255764,1256070,CVE-2025-15444,CVE-2025-69277
This update for libsodium fixes the following issues:
Update to 1.0.22 (jsc#PED-16890):
* Post-quantum key encapsulation is now available. ML-KEM768, the
NIST-standardized lattice-based KEM, is accessible through the
crypto_kem_mlkem768_*() functions.
* X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection
against both classical and quantum adversaries, is available through the
crypto_kem_*() functions. X-Wing is the recommended KEM for most
applications.
* SHA-3 hash functions are now available as crypto_hash_sha3256_*()
and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.
* Performance: NEON optimizations for Argon2 on ARM platforms.
* Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when
available on ARM platforms.
* Performance: WebAssembly SIMD implementations of Argon2 have been added.
* XOF state alignment has been relaxed.
* crypto_core_keccak1600_state has been added.
* Export missing crypto_ipcrypt_nd_keygen() helper function.
* crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now
accept NULL key pointers (with a zero key length), for consistency with
other _init functions.
* Fixed compilation with GCC on aarch64 and gcc 4.x.
* On aarch64, aes256-gcm is now enabled even when not using clang,
including MSVC.
* Libsodium can be directly used as a dependency in a Zig project.
Update to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277):
* The new crypto_ipcrypt_* functions implement mechanisms for securely
encrypting and anonymizing IP addresses.
* The sodium_bin2ip and sodium_ip2bin helper functions have been added to
complement the crypto_ipcrypt_* functions and easily convert addresses
between bytes and strings.
* XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
* standard
extendable output functions. From input of any length, they can derive
output of any length with the same properties as hash functions. These
primitives are required by many post-quantum mechanisms, but can also be
used for a wide range of applications, including key derivation, session
encryption and more.
* Performance of AES256-GCM and AEGIS on ARM has been improved with some
compilers
* Security: optblockers have been introduced in critical code paths to prevent
compilers from introducing unwanted side channels via conditional jumps. This
was observed on RISC-V targets with specific compilers and options.
* Security: crypto_core_ed25519_is_valid_point() now properly rejects
small-order points that are not in the main subgroup
* ((nonnull)) attributes have been relaxed on some crypto_stream* functions to
allow NULL output buffers when the output length is zero
* A cross-compilation issue with old clang versions has been fixed
* crypto_aead_aes256gcm_is_available is exported to JavaScript
* Security: memory fences have been added after MAC verification in AEAD to
prevent speculative access to plaintext before authentication is complete
* Assembly files now include .gnu.property notes for proper IBT and Shadow
Stack support when building with CET instrumentation.
Update to 1.0.20:
* build system updates and portability fixes
Includes changes from 1.0.19:
* New AEADs: AEGIS-128L and AEGIS-256
* The HKDF key derivation mechanism, required by many standard
protocols
- A test designed to trigger an OOM condition didn't work on
Linux systems with memory overcommit turned on. It has been
- Emscripten: UTF8ToString() is now exported since
- New target: WebAssembly/WASI
- New functions to map a hash to an edwards25519 point
or get a random point:
- crypto_core_ed25519_scalar_mul() has been implemented for
- Support for the Ristretto group has been implemented for
- Bug fix: sodium_pad() didn't properly support block sizes
- JS/WebAssembly: some old iOS versions can't instantiate the
crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't
returnEINVAL` on input strings with a short length, unlike
- Added a workaround for Visual Studio 2010 bug causing CPU
- New low-level APIs for arithmetic mod the order of the prime
- crypto_core_ed25519_scalar_random(),
- crypto_core_ed25519_scalar_invert(),
- crypto_core_ed25519_scalar_complement(),
crypto_core_ed25519_scalar_add() and
crypto_scalarmult_ed25519_base_noclamp() and
crypto_scalarmult_ed25519_noclamp().
* AVX2 detection is more reliable.
Intel platforms. crypto_generichash() is now faster than MD5 and
* In addition to sodium_bin2hex(), sodium_hex2bin() is now a
* crypto_generichash_statebytes(), crypto_auth_*_statebytes()
and crypto_hash_*_statebytes() have been added in order to
retrieve the size of structures keeping states from foreign
* The JavaScript target doesn't require /dev/urandom or an
external randombytes() implementation any more. Other minor
Emscripten-related improvements have been made in order to
* Custom randombytes implementations do not need to provide
their own implementation of randombytes_uniform() any more.
randombytes_stir() and randombytes_close() can also be NULL
* On Linux, getrandom(2) is being used instead of directly
accessing /dev/urandom, if the kernel supports this system
Also libsodium users were rebuilt: zeromq, dnsdist, unbound, php7, and usbguard.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4386-1
Released: Tue Sep 29 09:01:03 2026
Summary: Security update for perl-DBI
Type: security
Severity: important
References: 1281704,CVE-2026-78030
This update for perl-DBI fixes the following issue:
- CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in `DBD::DBM`
(bsc#1281704).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4394-1
Released: Tue Sep 29 13:52:17 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base
Type: security
Severity: important
References: 1273856,1273857,1277883,1278008,1280125,1282491,1282492,1282505,1282639,1282640,1282641,1282645,CVE-2026-18401,CVE-2026-19032,CVE-2026-68494,CVE-2026-68495,CVE-2026-68496,CVE-2026-68497,CVE-2026-68498,CVE-2026-83557,CVE-2026-89407,CVE-2026-89425,CVE-2026-91776,CVE-2026-91777
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues
(bsc#1273856).
- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for
unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).
Changes for jackson-annotations:
- Update to 2.18.11
Changes for jackson-bom:
- Update to 2.18.11
Changes for jackson-core:
- Update to 2.18.11
* #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,
CVE-2026-89407)
* #1698: UTF8DataInputJsonParser does not honor
maxErrorTokenLength when reporting an unrecognized token
(bsc#1282505, CVE-2026-89425)
* #1642: Fix maxDocumentLength bypass in async parser
single-feedInput() case [GHSA-2c4j-63jj-9fqr]
* #1643: Enforce maxNameLength incrementally in
ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)
of async parser (bsc#1273857, CVE-2026-68494)
non-blocking (async) parser (bsc#1273856, CVE-2026-18401)
Changes for jackson-databind:
- Update to 2.18.11
* #6185: Bracket unresolved IPv6 host name in InetSocketAddress
serialization
* #6203: Prevent unbounded growth of type id cache in
TypeDeserializer (bsc#1282491, CVE-2026-91776)
* #6204: Avoid quadratic forward-reference resolution in
Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
* #6099: Resolve classes without initialization in
TypeFactory.findClass()
* #6116: Reject non-ASCII digits in InetAddress literal validation
* #6127: Add StreamReadConstraints number len constraint to
javax.xml.datatype.XMLGregorianCalendar and
javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
* #6129: Limit the supported URL schemes for java.nio.file.Path
deserialization (bsc#1277883, CVE-2026-19032)
* #6156: Add java.lang.Comparable in set of unsafe polymorphic
base types (bsc#1278008, CVE-2026-83557)
* #6165: Apply number length limits to BigDecimal/BigInteger/
/Double/Float Map keys
Changes for jackson-dataformat-xml:
- Update to 2.18.11
* Fix build to avoid past-JDK-8 bytecode generation
* #891: Enforce StreamReadConstraints.maxNestingDepth in
FromXmlParser
Changes for jackson-dataformats-binary:
- Update to 2.18.11
* #783: (protobuf) Support StreamReadConstraints.maxDocumentLength
in ProtobufParser
* #785: (avro) Support StreamReadConstraints.maxDocumentLength and
maxTokenCount in Avro parser
* #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion
parser (partial fix for #358)
* #805: (ion) Support StreamReadConstraints.maxDocumentLength in
Ion parser (partial fix for #358)
* #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser
(bsc#1282639, CVE-2026-68495)
* #726: (smile) Ensure maxNameLength limit enforced for Smile
parser (bsc#1282640, CVE-2026-68496)
* #727: (cbor) CBORParser.nextFieldName(SerializableString)
confuses 5-bit length marker 23 with 24 ('1-byte length suffix
follows')
* #728: (cbor) CBORParser.nextFieldName(SerializableString)
consumes Object entry slot twice on fast-path miss, truncating
definite-length Objects
* #733: (cbor) Long `String`s not added to 'stringref' reference
table, breaking following references
* #735: (cbor) 'stringref' property-name paths pass 5-bit length
marker instead of actual length to shouldReferenceString()
* #736: (cbor) Long Object property names added to 'stringref'
reference table twice
Changes for jackson-modules-base:
- Update to 2.18.11
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4397-1
Released: Tue Sep 29 15:35:45 2026
Summary: Security update for libXrender
Type: security
Severity: important
References: 1280911,CVE-2026-88807
This update for libXrender fixes the following issue:
- CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow (bsc#1280911).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4403-1
Released: Wed Sep 30 13:51:51 2026
Summary: Security update for python-tornado6
Type: security
Severity: important
References: 1280689,1281059,1281439,1281440,CVE-2023-54397,CVE-2024-58384,CVE-2026-91990,CVE-2026-91991
This update for python-tornado6 fixes the following issues:
- CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of
Content-Length headers accepting non-standard characters. At (bsc#1280689).
- CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
- CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for resource exhaustion
and a denial of service (bsc#1281439).
- CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via semicolon-
delimited data in capitalized parameters (bsc#1281440).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4414-1
Released: Fri Oct 2 09:37:26 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,1281125,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
Other non-security fixes:
- Add a conflicts with previous crypto-policies versions (bsc#1281125)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4443-1
Released: Mon Oct 5 10:18:35 2026
Summary: Security update for python-msgpack
Type: security
Severity: important
References: 1269947,CVE-2026-57585
This update for python-msgpack fixes the following issue
- CVE-2026-57585: `Unpacker` reuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4462-1
Released: Mon Oct 5 13:05:43 2026
Summary: Recommended update for libvirt
Type: recommended
Severity: important
References: 1265974,1279561,1280884
This update for libvirt fixes the following issues:
- qemu:
* Fix missing audit record and shutdown lifecycle event of
VMs with shutdown times exceeding 40 seconds (bsc#1280884)
* Fix cleanup of VMs with shutdown times exceeding 40 seconds (bsc#1265974)
* Fix hot plugged host CPUs not being used (bsc#1279561)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4502-1
Released: Mon Oct 5 17:03:47 2026
Summary: Security update for libX11
Type: security
Severity: important
References: 1280910,1281653,1281657,1281661,CVE-2026-88806,CVE-2026-94283,CVE-2026-94284,CVE-2026-94285
This update for libX11 fixes the following issues:
- CVE-2026-88806: XkbGetMap Reply Heap-based Buffer Overflow (bsc#1280910).
- CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (bsc#1281653).
- CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser
(bsc#1281657).
- CVE-2026-94285: out-of-bounds read in libX11's byte-oriented codeset parser (bsc#1281661).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4525-1
Released: Tue Oct 6 08:25:53 2026
Summary: Recommended update for grub2
Type: recommended
Severity: moderate
References: 1278729
This update for grub2 fixes the following issues:
- Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4544-1
Released: Tue Oct 6 12:00:55 2026
Summary: Security update for libtcnative-1-0, tomcat11
Type: security
Severity: critical
References: 1282581,1282599,1282620,1282621,1282622,1282623,1282624,1282625,1282626,1282627,1282628,1282629,1282630,1282631,1282787,622430,CVE-2026-73581,CVE-2026-75973,CVE-2026-76183,CVE-2026-77756,CVE-2026-77762,CVE-2026-77791,CVE-2026-78383,CVE-2026-78437,CVE-2026-79677,CVE-2026-86243,CVE-2026-86246,CVE-2026-86247,CVE-2026-86248,CVE-2026-86350,CVE-2026-87022
This update for libtcnative-1-0, tomcat11 fixes the following issues:
Security issues fixed:
libtcnative-1-0:
- CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash
(bsc#1282623).
- CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and
ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
- CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some
configurations (bsc#1282621).
tomcat11:
- CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
(bsc#1282631).
- CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider`
(bsc#1282630).
- CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
- CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user
to fail when Tomcat is located behind a reverse proxy (bsc#1282628).
- CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).
- CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack
(bsc#1282627).
- CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an
AJP processing thread leading to denial of service (bsc#1282626).
- CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail
(bsc#1282625).
- CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for
denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).
- CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
(bsc#1282620).
- CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).
- CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).
Changes for libtcnative-1-0:
- Update to 1.3.9
* Security fixes
+ Client certificate requirements can be down-graded
(bsc#1282621, CVE-2026-86247)
A race condition allowed client certificate verification
requirements to be down-graded for some configurations.
+ Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246)
Apache Tomcat Native enabled insecure options by default
including ALLOW_CLIENT_RENEGOTIATION,
NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and
ALLOW_NO_DHE_KEX.
+ DoS via TLS handshake (bsc#1282623, CVE-2026-86243)
A buffer over-read vulnerability in Apache Tomcat Native
during the TLS handshaking permits a malicious user to trigger
a DoS via a JVM crash.
* Changes
+ Code: Remove call to ERR_remove_thread_state() from Windows
specific code to allow building with OpenSSL 4.0.x.
ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got
removed in OpenSSL 4
+ Fix: Fix a potential crash when negotiating ALPN
+ If ALPN negotiation fails and failure is configured to use
the last server protocol in the list, use it rather than the
last protocol offered by the client
+ Fix: Add support for the extended range of options available
from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned
int (represented by a Java long) rather than a 32-bit unsigned
int (represented by a Java int)
+ Code: Remove unused code
+ Ensure that per connection changes to certificate verification
settings, e.g. to support client certificate authentication,
do not modify the certificate verification settings for other
connections
+ Fix: Fix a potential crash when configuring raw certificates
+ Fix: Avoid a potential crash with very long ALPN protocol
names
+ Fix: Make the call to a CertificateVerifier more robust
+ Fix: Avoid a potential crash when processing OCSP URLs
+ Fix: Make the processing of OCSP responses more robust
+ Fix: Stricter OCSP handling when soft-fail is disabled
+ Fix: Harden against the mis-use of Buffer.address(ByteBuffer)
+ Fix: Harden against the mis-use of Pool.destroy(long)
+ Code: The minimum supported OpenSSL version is now 3.0.x.
OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no
bug reports were receive for that failure and since both
Debian and Ubuntu versions that used OpenSSL 1.1.1 have
reached end of support, OpenSSL 1.1.1 is no longer supported
+ Update: OpenSSL 3.0.x is approaching end of support so the
recommended version of OpenSSL (and the version that windows
binaries will be built with) now follows the 3.5.x LTS branch
+ Fix: Switch to automatic configuration of DH parameters.
Manual configuration attempts will be ignored
+ Code: Make setTmpECDHByCurveName() a NO-OP
+ Fix: Refactor extraction of ECDH curve name from the
Certificate to avoid deprecated OpenSSL methods
+ Fix: Refactor the native implementation of SSL.getTime() to
avoid the Y2038 problem in SSL_SESSION_get_time() when running
on a verion of OpenSSL that includes the new
SSL_SESSION_get_time_ex() method
Changes for tomcat11:
- Update to Tomcat 11.0.26
* Catalina
+ Fix: Improve the handling of AsyncContext.dispatch() when the Context
attribute dispatchersUseEncodedPaths is set to false since the
application has no control over the path used for the
AsyncContext.dispatch(). Prior to this fix, paths containing literal '?'
characters were truncated. (markt)
+ Fix: Ensure that capture groups from a RewriteCond always reflect the
result of the current request. (markt)
+ Fix: When a PersistentManager needs to reduce the number of active
sessions, swap out the least recently used eligible sessions first. Pull
request #1045 provided by sainadh777. (markt)
+ Fix: Align web.xml logging output with the new Context attribute
urlPatternsProvidedInDecodedForm. (markt)
+ Fix: Improve robustness of DIGEST authentication to system clock jumps.
(markt)
+ Add: Support multiple protocol header values (treat as a single merged
header value) in the RemoteIpFilter and RemoteIpValve. (markt)
+ Fix: potential concurrency issues when loading/saving sessions from/to a
session store. Custom Store implementations that do not extend StoreBase
must implement the new getSessionStoreLock() method of the Store
interface to ensure concurrency protection. The default method
implementation provided only provides the pre-fix functionality. (markt)
+ Fix: Ensure that PersistentManager implementations that extend
PersistentManagerBase do not swap out sessions that are associated with
a request that is currently being processed. This includes not swapping
out a session unless the session was created when activity tracking was
enabled. (markt)
+ Fix: Ensure namespace attributes are XML escaped in WebDAV responses.
+ Fix: Resolve null or missing rewrite substitutions as an empty string,
to align with the mod_rewrite behavior. (remm)
+ Add: a best efforts protection in the CrawlerSessionManagerValve against
crawlers being associated with an authenticated session. (markt)
+ Fix: Clarify the meaning of various RewriteValve server variables and
explicitly use the canonical context path for the CONTEXT_PATH server
variable. (markt)
+ Fix: storeconfig not saving the path when a context is saved in
server.xml. (remm)
+ Fix: WAR URLConnection should propagate use of caching. (remm)
+ Fix: Ensure resources are evicted from the static resource cache in the
correct order. (markt)
+ Fix: When Jakarta Authentication is configured for a web application,
cache the ServerAuthConfig in the Authenticator valve. This ensures web
application specific settings are cached on a per web application basis.
+ Fix: 70203: Fix RegistrationListener notifications in Jakarta
Authentication implementation. (markt)
+ Fix: Handle CGI scripts that write excessively to stdout after setting
an HTTP error status code. (schultz)
+ Fix: Require the request to the login action during FORM authentication
to be made using HTTP POST. (markt)
+ Fix: 70208: Make URL encoding more robust. Based on pull request #1065
by Chenjp. (markt)
* Coyote
+ Fix: parsing of client certificates that specify more than one OCSP
responder for configurations that use OpenSSL-FFM. (markt)
+ Fix: xreflection generated code stack overflow issue. (remm)
+ Fix: Align xreflection better with IntrospectionUtils. (remm)
+ Fix: In HTTP/2 after half closed (remote), any unexpected frame should
be a stream error. (remm)
+ Fix: incorrect initial window size calculation when upgrading to HTTP/2.
(remm)
+ Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)
+ Fix: Only try and load the native library from the CATALINA_HOME system
property when the property is set. (markt)
+ Fix: max connections enforcement after an enpoint resume. (remm)
+ Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)
+ Add: length validation for ALPN protocol names. (markt)
+ Fix: Make FFM certificate verification more robust. (markt)
+ Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing
failure as if no usable OCSP URLs were present. (markt)
+ Fix: Make the processing of OCSP responses more robust. (markt)
+ Fix: Stricter OCSP handling when soft-fail is disabled. (markt)
+ Fix: Cleaner handling of AJP response headers which overflow the maximum
message size. (remm)
+ Fix: Small per performance optimisation. Don't waste cycles swallowing
an AJP response body when the connection is going to be closed. (markt)
+ Fix: OpenSSL support for CRLs when using OpenSSL trust with the server
key held in a Java key store. (markt)
+ Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding
header. (markt)
+ Fix: Ensure per request HTTP/2 bad request marker is cleared when the
request is recycled. (markt)
+ Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)
+ Fix: Revert earlier refactoring of HTTP/2 header field validation that
moved it earlier since the refactoring made correct handling of invalid
headers more difficult. (markt)
* Jasper
+ Fix: EL evaluation of some lambda expressions. (remm)
* WebSocket
+ Fix: an exception when an automatic Pong response races with the closing
of the WebSocket session. (moritzfl)
+ Fix: Harden the WebSocket client and use a SecureRandom when generating
the Sec-WebSocket-Key header. (markt)
+ Fix: Improve robustness of client handshakes. (remm)
+ Fix: Ensure that WebSocket write timeouts apply to the complete message
and are not lost if two writes have the same timeout. (markt)
+ Fix: Reduce CPU usage while sending WebSocket close message. (markt)
+ Fix: overly broad check that prevented request URIs containing literal {
and } characters from being mapped to WebSocket end points. (markt)
+ Fix: handling of WebSocket messages with compressed payloads using per-
message-deflate that have one or more non-final blocks where the BFINAL
bit is set. (markt)
+ Fix: handling of per-message-deflate context takeover when receiving
compressed WebSocket messages. (markt)
* Web applications
+ Fix: Manager: Fix a potential concurrency issue when ordering sessions
prior to displaying a list of session. (markt)
+ Docs: Wrap the RewriteRule regular expression syntax reference on narrow
displays. Pull request #1044 by sainadh777. (markt)
* Other
+ Update: Easymock to 5.7.0. (markt)
+ Update: bnd to 7.4.0. (markt)
+ Update: Tomcat Native to 2.0.16. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji and
Ktamura.biz.80. (markt)
* Cluster
+ Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a
positive integer. Zero or negative values previously caused an infinite
loop or a NegativeArraySizeException during session state transfer. Pull
request #1042 provided by lihongyi87. (markt)
+ Fix: Improve robustness of cloud membership providers if an error occurs
fetching members. (remm)
* jdbc-pool
+ Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to
getConnection(String,String) rather than getConnection(). (markt)
+ Add: Log a warning if an attempt is made to obtain a connection with
credentials when alternateUsernameAllowed is set to false. (markt)
+ Fix: Ensure StatementCache interceptor resets properties of cached
statements between uses. (mark)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4566-1
Released: Wed Oct 7 17:21:07 2026
Summary: Security update for libXtst
Type: security
Severity: important
References: 1281665,CVE-2026-94286
This update for libXtst fixes the following issue:
- CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser (bsc#1281665).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4571-1
Released: Thu Oct 8 10:02:12 2026
Summary: Maintenance update for Multi-Linux Manager 5.2: Server, Proxy and Retail Branch Server
Type: security
Severity: important
References: 1208800,1230568,1230949,1252286,1257151,1258382,1258500,1258567,1259225,1260342,1262157,1263822,1265219,1265472,1266481,1267261,1267871,1267912,1268228,1268325,1268473,1268587,1268673,1268755,1269192,1269253,1269316,1269534,1269679,1270033,1270039,1270040,1270047,1270141,1270694,1271075,1271116,1271124,1271329,1271332,1271382,1271467,1271523,1271678,1271681,1271841,1271902,1271963,1272298,1272392,1272404,1272538,1272621,1272988,1273073,1273131,1273144,1273846,1273853,1274023,1274227,1274613,1274720,1274775,CVE-2026-39821,CVE-2026-63007,CVE-2026-63009,CVE-2026-71400
Maintenance update for Multi-Linux Manager 5.2: Server, Proxy and Retail Branch Server
This is a codestream only update
The following package changes have been done:
- crypto-policies-20250714.cd6043a-150700.6.4.2 updated
- libssh-config-0.9.8-150600.11.15.1 updated
- libtirpc-netconfig-1.3.4-150300.3.26.1 updated
- glibc-2.38-150600.14.58.1 updated
- libuuid1-2.40.4-150700.4.18.1 updated
- libsmartcols1-2.40.4-150700.4.18.1 updated
- libpcre2-8-0-10.42-150600.3.3.1 updated
- libnghttp2-14-1.64.0-150700.3.6.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libbz2-1-1.0.8-150400.3.4.1 updated
- libattr1-2.6.0-150000.4.3.1 updated
- libacl1-2.4.0-150000.4.6.1 updated
- libglib-2_0-0-2.78.6-150600.4.41.1 updated
- libxml2-2-2.12.10-150700.4.14.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- libudev1-254.27-150600.4.71.2 updated
- libusb-1_0-0-1.0.24-150400.3.6.1 updated
- login_defs-4.17.2-150600.17.24.1 updated
- cpio-2.13-150400.3.10.1 updated
- libgcrypt20-1.11.0-150700.5.10.1 updated
- libblkid1-2.40.4-150700.4.18.1 updated
- perl-base-5.26.1-150300.17.23.1 updated
- gpg2-2.4.4-150600.3.18.1 updated
- permissions-20250826-150700.16.5.1 updated
- libopenssl3-3.5.0-150700.5.53.2 updated
- libmount1-2.40.4-150700.4.18.1 updated
- libfdisk1-2.40.4-150700.4.18.1 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.53.2 updated
- krb5-1.20.1-150600.11.19.1 updated
- libtirpc3-1.3.4-150300.3.26.1 updated
- libssh4-0.9.8-150600.11.15.1 updated
- libcurl4-8.14.1-150700.7.26.1 updated
- rpm-ndb-4.14.3-150400.59.19.1 updated
- pam-1.3.0-150000.6.89.1 updated
- libsubid5-4.17.2-150600.17.24.1 updated
- libzypp-17.38.15-150700.6.16.1 updated
- shadow-4.17.2-150600.17.24.1 updated
- zypper-1.14.101-150700.13.9.1 updated
- util-linux-2.40.4-150700.4.18.1 updated
- curl-8.14.1-150700.7.26.1 updated
- gzip-1.10-150200.16.1 updated
- openssl-3.5.0-150700.3.4.1 updated
- openssl-3-3.5.0-150700.5.53.2 updated
- timezone-2026c-150600.91.12.1 updated
- kbd-2.4.0-150700.15.10.1 updated
- libkmod2-29-150600.13.6.1 updated
- libsystemd0-254.27-150600.4.71.2 updated
- systemd-254.27-150600.4.71.2 updated
- bzip2-1.0.8-150400.3.4.1 updated
- dmidecode-3.7-150400.16.14.1 updated
- gawk-4.2.1-150000.3.6.1 updated
- glibc-locale-base-2.38-150600.14.58.1 updated
- libX11-data-1.8.10-150700.4.8.1 updated
- libarchive13-3.7.2-150600.3.23.1 updated
- libasound2-1.2.10-150600.4.3.1 updated
- libatomic1-15.3.0+git11272-150000.1.12.1 updated
- libavahi-common3-0.8-150600.15.21.1 updated
- libcares2-1.34.8-150000.3.29.1 updated
- libfreebl3-3.125-150400.3.74.1 updated
- libfreeipmi17-1.6.8-150400.3.6.1 updated
- libgmodule-2_0-0-2.78.6-150600.4.41.1 updated
- libgobject-2_0-0-2.78.6-150600.4.41.1 updated
- libgomp1-15.3.0+git11272-150000.1.12.1 updated
- libidn11-1.34-150000.3.5.1 updated
- libipa_hbac0-2.10.2-150700.9.40.1 updated
- libitm1-15.3.0+git11272-150000.1.12.1 updated
- liblcms2-2-2.15-150600.3.6.1 updated
- liblsan0-15.3.0+git11272-150000.1.12.1 updated
- libopenssl1_1-1.1.1w-150700.11.30.1 updated
- libpng16-16-1.6.58-150600.3.23.1 updated
- libpq5-18.6-150600.13.16.1 updated
- libquadmath0-15.3.0+git11272-150000.1.12.1 updated
- libsgutils2-1_48-2-1.48+13.88f0f67-150600.3.9.1 updated
- libsodium26-1.0.22-150000.4.17.1 added
- libssh2-1-1.11.0-150600.20.6.1 updated
- libsss_idmap0-2.10.2-150700.9.40.1 updated
- libsss_nss_idmap0-2.10.2-150700.9.40.1 updated
- libyaml-0-2-0.1.7-150000.3.4.1 added
- mozilla-nspr-4.39-150400.12.3.1 updated
- openssh-common-9.6p1-150600.6.49.1 updated
- patch-2.7.6-150000.5.12.1 updated
- perl-Bootloader-1.28-150700.3.6.1 updated
- python-rpm-macros-20260908.1ec0542-150400.3.24.1 updated
- python311-base-3.11.15-150600.3.65.1 updated
- libpython3_11-1_0-3.11.15-150600.3.65.1 updated
- release-notes-multi-linux-manager-5.2.1-150750.9.3.5 updated
- susemanager-schema-utility-5.2.14-150750.3.3.10 updated
- uyuni-config-modules-5.2.15-150750.3.3.5 updated
- vim-data-common-9.2.0957-150500.20.64.1 updated
- supportutils-3.2.14.2-150600.3.12.1 updated
- glibc-locale-2.38-150600.14.58.1 updated
- libtcnative-2-0-2.0.15-150400.9.3.1 added
- libavahi-client3-0.8-150600.15.21.1 updated
- perl-5.26.1-150300.17.23.1 updated
- libapr-util1-1.6.1-150600.27.3.1 updated
- postgresql-18-150700.23.6.1 updated
- postgresql18-18.6-150600.13.16.1 updated
- sg3_utils-1.48+13.88f0f67-150600.3.9.1 updated
- libsss_certmap0-2.10.2-150700.9.40.1 updated
- libzmq5-4.2.3-150000.3.17.1 updated
- bind-utils-9.20.29-150700.3.32.2 updated
- glibc-devel-2.38-150600.14.58.1 updated
- mozilla-nss-certs-3.125-150400.3.74.1 updated
- openssh-fips-9.6p1-150600.6.49.1 updated
- python311-3.11.15-150600.3.65.1 updated
- susemanager-docs_en-5.2.1-150750.8.3.6 updated
- policycoreutils-3.5-150600.3.3.1 updated
- libgio-2_0-0-2.78.6-150600.4.41.1 updated
- glib2-tools-2.78.6-150600.4.41.1 updated
- spacewalk-java-lib-5.2.22-150750.3.3.13 updated
- libX11-6-1.8.10-150700.4.8.1 updated
- vim-9.2.0957-150500.20.64.1 updated
- perl-URI-1.73-150000.3.3.1 updated
- perl-HTTP-Date-6.02-150000.3.3.1 updated
- perl-DBI-1.647.0-150600.12.21.1 updated
- apache2-prefork-2.4.66-150700.4.23.1 updated
- openssh-server-9.6p1-150600.6.49.1 updated
- openssh-clients-9.6p1-150600.6.49.1 updated
- python3-zypp-plugin-0.6.5-150600.18.10.1 updated
- python3-susemanager-retail-1.2.1-150750.3.3.6 updated
- python3-rpm-4.14.3-150400.59.19.1 updated
- python3-idna-2.6-150000.3.9.1 updated
- adcli-0.9.3.1-150600.22.8.1 updated
- libldb2-4.21.10+git.533.31d7e5508d-150700.3.29.1 updated
- postfix-3.8.4-150700.6.3.1 updated
- mozilla-nss-3.125-150400.3.74.1 updated
- libsoftokn3-3.125-150400.3.74.1 updated
- susemanager-tools-salt-5.2.10-150750.3.3.4 updated
- python311-zypp-plugin-0.6.5-150600.18.10.1 updated
- python311-tornado6-6.3.2-150400.9.27.1 updated
- python311-toml-0.10.2-150400.5.7.1 updated
- python311-rpm-4.14.3-150400.59.19.1 updated
- python311-pyasn1-0.5.0-150400.12.16.1 updated
- python311-msgpack-1.0.7-150600.3.5.1 updated
- python311-idna-3.4-150400.11.13.1 updated
- susemanager-docs_en-pdf-5.2.1-150750.8.3.6 updated
- susemanager-schema-5.2.14-150750.3.3.10 updated
- susemanager-sync-data-5.2.6-150750.3.3.6 updated
- rsync-3.2.7-150600.3.24.1 updated
- libXrender1-0.9.10-150000.3.3.1 updated
- apache2-2.4.66-150700.4.23.1 updated
- openssh-9.6p1-150600.6.49.1 updated
- grub2-2.12-150700.19.37.1 updated
- grub2-i386-pc-2.12-150700.19.37.1 updated
- libvirt-libs-11.0.0-150700.4.30.1 updated
- susemanager-retail-tools-1.2.1-150750.3.3.6 updated
- spacewalk-backend-sql-postgresql-5.2.10-150750.3.3.10 updated
- python3-lxml-4.9.1-150500.3.7.1 updated
- supportutils-plugin-susemanager-5.2.3-150750.3.3.6 updated
- sssd-ldap-2.10.2-150700.9.40.1 updated
- sssd-2.10.2-150700.9.40.1 updated
- sssd-krb5-common-2.10.2-150700.9.40.1 updated
- samba-client-libs-4.21.10+git.533.31d7e5508d-150700.3.29.1 updated
- mozilla-nss-sysinit-3.125-150400.3.74.1 updated
- libXtst6-1.2.3-150000.3.3.1 updated
- perl-HTML-Parser-3.830.0-150000.3.6.1 updated
- susemanager-build-keys-15.5.3-150750.7.3.6 updated
- grub2-x86_64-efi-2.12-150700.19.37.1 updated
- grub2-powerpc-ieee1275-2.12-150700.19.37.1 updated
- grub2-arm64-efi-2.12-150700.19.37.1 updated
- spacecmd-5.2.10-150750.3.3.8 updated
- sssd-krb5-2.10.2-150700.9.40.1 updated
- sssd-dbus-2.10.2-150700.9.40.1 updated
- python3-sssd-config-2.10.2-150700.9.40.1 updated
- sssd-ad-2.10.2-150700.9.40.1 updated
- java-17-openjdk-headless-17.0.20.1-150400.3.72.1 updated
- python311-cryptography-41.0.3-150600.23.9.1 updated
- spacewalk-base-minimal-5.2.14-150750.3.3.14 updated
- perl-libwww-perl-6.31-150000.3.3.1 updated
- susemanager-build-keys-web-15.5.3-150750.7.3.6 updated
- spacewalk-config-5.2.5-150750.3.3.6 updated
- rpm-build-4.14.3-150400.59.19.1 updated
- sssd-tools-2.10.2-150700.9.40.1 updated
- sssd-ipa-2.10.2-150700.9.40.1 updated
- tomcat11-servlet-6_1-api-11.0.26-150600.13.36.2 updated
- tomcat11-el-6_0-api-11.0.26-150600.13.36.2 updated
- stax2-api-4.3.0-150200.3.8.1 updated
- java-17-openjdk-17.0.20.1-150400.3.72.1 updated
- jackson-core-2.18.11-150200.3.30.1 updated
- jackson-annotations-2.18.11-150200.3.28.1 updated
- apache-commons-lang3-3.20.0-150200.3.15.2 updated
- spacewalk-base-minimal-config-5.2.14-150750.3.3.14 updated
- python3-pyOpenSSL-21.0.0-150400.22.1 updated
- tomcat11-jsp-4_0-api-11.0.26-150600.13.36.2 updated
- woodstox-core-7.2.1-150200.3.10.1 updated
- objectweb-asm-9.10.1-150750.3.3.12 updated
- jackson-databind-2.18.11-150200.3.36.1 updated
- guava-33.2.1-150200.3.15.1 updated
- apache-commons-fileupload2-core-2.0.0~M5-150750.3.3.9 updated
- python311-urllib3-2.0.7-150400.7.33.1 updated
- python3-urllib3-1.25.10-150300.4.30.1 updated
- spacewalk-base-5.2.14-150750.3.3.14 updated
- tomcat11-lib-11.0.26-150600.13.36.2 updated
- byte-buddy-1.18.8-150750.3.3.4 updated
- httpcomponents-client-4.5.14-150200.3.12.1 updated
- apache-commons-compress-1.28.0-150200.3.21.1 updated
- jackson-dataformat-xml-2.18.11-150200.5.8.1 added
- apache-commons-fileupload2-jakarta-servlet6-2.0.0~M5-150750.3.3.9 updated
- spacewalk-backend-5.2.10-150750.3.3.10 updated
- python3-spacewalk-client-tools-5.2.7-150750.3.3.8 updated
- spacewalk-client-tools-5.2.7-150750.3.3.8 updated
- log4j-2.26.1-150200.4.42.1 updated
- salt-3006.0-150750.9.3.10 updated
- python311-salt-3006.0-150750.9.3.10 updated
- spacewalk-backend-sql-5.2.10-150750.3.3.10 updated
- mgr-push-5.2.5-150750.3.3.4 updated
- python3-mgr-push-5.2.5-150750.3.3.4 updated
- spacewalk-search-5.2.6-150750.3.3.5 updated
- log4j-slf4j-2.26.1-150200.4.42.1 updated
- log4j-jcl-2.26.1-150200.4.42.1 updated
- salt-master-3006.0-150750.9.3.10 updated
- spacewalk-backend-server-5.2.10-150750.3.3.10 updated
- tomcat11-11.0.26-150600.13.36.2 updated
- struts-1.2.9-150750.165.3.5 updated
- subscription-matcher-0.47-150750.3.3.6 updated
- salt-api-3006.0-150750.9.3.10 updated
- spacewalk-backend-xmlrpc-5.2.10-150750.3.3.10 updated
- spacewalk-backend-xml-export-libs-5.2.10-150750.3.3.10 updated
- spacewalk-backend-package-push-server-5.2.10-150750.3.3.10 updated
- spacewalk-backend-app-5.2.10-150750.3.3.10 updated
- spacewalk-java-postgresql-5.2.22-150750.3.3.13 updated
- spacewalk-java-config-5.2.22-150750.3.3.13 updated
- spacewalk-branding-5.2.7-150750.3.3.5 updated
- spacewalk-taskomatic-5.2.22-150750.3.3.13 updated
- spacewalk-java-5.2.22-150750.3.3.13 updated
- spacewalk-html-5.2.14-150750.3.3.14 updated
- spacewalk-backend-tools-5.2.10-150750.3.3.10 updated
- susemanager-sls-5.2.15-150750.3.3.5 updated
- susemanager-tools-5.2.10-150750.3.3.4 updated
- susemanager-5.2.10-150750.3.3.4 updated
- spacewalk-utils-5.2.8-150750.3.3.5 updated
- container:bci-bci-init-15.7-e64630d2cdd3d43ab1a448ed1dd2ca67dfaf5c9829c21b8bd318ee740ebeaf6a-0 added
- container:registry.suse.com-bci-bci-init-15.7-78d7c53c5c9d133dade10b227e8c8d97ab1f950bc625d9bb707c3a34802526e5-0 removed
- libsodium23-1.0.18-150000.4.14.1 removed
- libtcnative-1-0-1.3.7-150600.16.3.1 removed
- openslp-2.0.0-150600.19.5 removed
- saltbundle-libyaml-0.2.5-150002.1.2 removed
More information about the sle-container-updates
mailing list