SUSE-SU-2026:3630-1: important: Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-cont
SLE-UPDATES
null at suse.de
Tue Aug 18 08:33:49 UTC 2026
# Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-
container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6,
virt-handler-container-1.6, virt-launcher-cont
Announcement ID: SUSE-SU-2026:3630-1
Release Date: 2026-08-17T16:50:38Z
Rating: important
References:
* bsc#1251420
* bsc#1251615
* bsc#1253935
* bsc#1254014
* bsc#1262265
* bsc#1265736
* bsc#1266575
* bsc#1267120
* bsc#1269093
* bsc#1272000
* bsc#1272840
* bsc#1273606
Cross-References:
* CVE-2025-47911
* CVE-2025-47914
* CVE-2025-58181
* CVE-2025-58190
* CVE-2026-13201
* CVE-2026-13622
* CVE-2026-25680
* CVE-2026-25681
* CVE-2026-27136
* CVE-2026-33814
* CVE-2026-35469
* CVE-2026-39821
* CVE-2026-42502
* CVE-2026-42506
* CVE-2026-46600
* CVE-2026-56852
CVSS scores:
* CVE-2025-47911 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-47911 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-47911 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-47914 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-47914 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-47914 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58181 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-58181 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58181 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58190 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58190 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58190 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-13201 ( SUSE ): 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
* CVE-2026-13201 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
* CVE-2026-13622 ( SUSE ): 9.3
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
* CVE-2026-13622 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-13622 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-25680 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-25680 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-25681 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-25681 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-27136 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-27136 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-35469 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-35469 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-35469 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-35469 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-39821 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-42502 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-42502 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-42506 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-42506 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-46600 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-46600 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56852 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56852 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56852 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* Containers Module 15-SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
An update that solves 16 vulnerabilities can now be installed.
## Description:
This update for kubevirt-1.6, virt-api-container-1.6, virt-controller-
container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6,
virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-
container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-
synchronization-controller-container-1.6 fixes the following issues:
Security issues fixed:
* CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic
complexity when parsing HTML documents allow for denial of service
(bsc#1251420).
* CVE-2025-47914: golang.org/x/crypto/ssh/agent: no validation of message size
when processing new identity requests can cause a panic due to an out-of-
bounds read (bsc#1254014).
* CVE-2025-58181: golang.org/x/crypto/ssh: no validation of number of
mechanisms in GSSAPI authentication requests can cause unbounded memory
consumption (bsc#1253935).
* CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by
`html.ParseFragment` when processing specially crafted input can lead to a
denial of service (bsc#1251615).
* CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath `OpenAtNoFollow`
symlink following via `/proc/self/fd` allows host file metadata modification
(bsc#1269093).
* CVE-2026-13622: virt-handler migration proxy follows symlinks and allows
container escape to host (bsc#1272840).
* CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506:
golang.org/x/net/html: multiple issues when parsing HTML files
(bsc#1267120).
* CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames
with a crafted `SETTINGS_MAX_FRAME_SIZE` can lead to an infinite loop and a
denial of service (bsc#1265736).
* CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-
controlled input in the SPDY/3 frame parser allows for a denial of service
via crafted SPDY frames (bsc#1262265).
* CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
Punycode-encoded labels allows for validation bypass and privilege
escalation (bsc#1266575).
* CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a
parameter value overflows the message buffer can lead to panic
(bsc#1273606).
* CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead
to an infinite loop (bsc#1272000).
Other updates and bugfixes:
* Fixed `printf`-style calls with non-constant format strings (`cmd/virt-
chroot`, `tests/`) that fail `go1.25`'s vet (toolchain required by the
`x/net` 0.55.0 re-vendor); rewritten with no behavior change.
* Build with Go >= 1.25 (required by `golang.org/x/net` 0.55).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Containers Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Containers-15-SP7-2026-3630=1
## Package List:
* Containers Module 15-SP7 (aarch64 x86_64)
* kubevirt-1.6-virtctl-debuginfo-1.6.6-150700.15.17.1
* kubevirt-1.6-manifests-1.6.6-150700.15.17.1
* kubevirt-1.6-virtctl-1.6.6-150700.15.17.1
## References:
* https://www.suse.com/security/cve/CVE-2025-47911.html
* https://www.suse.com/security/cve/CVE-2025-47914.html
* https://www.suse.com/security/cve/CVE-2025-58181.html
* https://www.suse.com/security/cve/CVE-2025-58190.html
* https://www.suse.com/security/cve/CVE-2026-13201.html
* https://www.suse.com/security/cve/CVE-2026-13622.html
* https://www.suse.com/security/cve/CVE-2026-25680.html
* https://www.suse.com/security/cve/CVE-2026-25681.html
* https://www.suse.com/security/cve/CVE-2026-27136.html
* https://www.suse.com/security/cve/CVE-2026-33814.html
* https://www.suse.com/security/cve/CVE-2026-35469.html
* https://www.suse.com/security/cve/CVE-2026-39821.html
* https://www.suse.com/security/cve/CVE-2026-42502.html
* https://www.suse.com/security/cve/CVE-2026-42506.html
* https://www.suse.com/security/cve/CVE-2026-46600.html
* https://www.suse.com/security/cve/CVE-2026-56852.html
* https://bugzilla.suse.com/show_bug.cgi?id=1251420
* https://bugzilla.suse.com/show_bug.cgi?id=1251615
* https://bugzilla.suse.com/show_bug.cgi?id=1253935
* https://bugzilla.suse.com/show_bug.cgi?id=1254014
* https://bugzilla.suse.com/show_bug.cgi?id=1262265
* https://bugzilla.suse.com/show_bug.cgi?id=1265736
* https://bugzilla.suse.com/show_bug.cgi?id=1266575
* https://bugzilla.suse.com/show_bug.cgi?id=1267120
* https://bugzilla.suse.com/show_bug.cgi?id=1269093
* https://bugzilla.suse.com/show_bug.cgi?id=1272000
* https://bugzilla.suse.com/show_bug.cgi?id=1272840
* https://bugzilla.suse.com/show_bug.cgi?id=1273606
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260818/a89b7845/attachment.htm>
More information about the sle-updates
mailing list