Chromium, Firefox, FreeRDP, and more updates for SUSE

SUSE 5572 Published by

A security update has been released for Chromium, which fixes three vulnerabilities (CVE-2026-3061, CVE-2026-3062, and CVE-2025-3063) in openSUSE Backports SLE-15-SP6. Another security update was also released for MozillaFirefox, addressing one vulnerability (CVE-2026-2447). Additionally, updates were issued to address various vulnerabilities in freerdp (seven issues), python311-Django4 (six issues), and firefox-esr (37 issues) on openSUSE Tumbleweed. Furthermore, security updates have been made for python-urllib3_1 (three issues), libsoup-2_4-1 (one issue), and cacti (two issues).

openSUSE-SU-2026:0062-1: important: Security update for chromium
SUSE-SU-2026:0611-1: important: Security update for MozillaFirefox
SUSE-SU-2026:0621-1: important: Security update for freerdp
openSUSE-SU-2026:10247-1: moderate: python311-Django4-4.2.28-1.1 on GA media
openSUSE-SU-2026:10243-1: moderate: freerdp2-2.11.7-5.1 on GA media
openSUSE-SU-2026:10241-1: moderate: cacti-1.2.30+git231.bca15e70c-1.1 on GA media
openSUSE-SU-2026:10246-1: moderate: libsoup-2_4-1-2.74.3-17.1 on GA media
openSUSE-SU-2026:10242-1: moderate: firefox-esr-140.8.0-1.1 on GA media
SUSE-SU-2026:0635-1: moderate: Security update for python-urllib3_1




openSUSE-SU-2026:0062-1: important: Security update for chromium


openSUSE Security Update: Security update for chromium
_______________________________

Announcement ID: openSUSE-SU-2026:0062-1
Rating: important
References: #1258733
Cross-References: CVE-2025-3063 CVE-2026-3061 CVE-2026-3062

Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for chromium fixes the following issues:

- Chromium 145.0.7632.116 (boo#1258733):
* CVE-2026-3061: Out of bounds read in Media
* CVE-2026-3062: Out of bounds read and write in Tint
* CVE-2025-3063: Inappropriate implementation in DevTools

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP6:

zypper in -t patch openSUSE-2026-62=1

Package List:

- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):

chromedriver-145.0.7632.116-bp156.2.242.1
chromium-145.0.7632.116-bp156.2.242.1

References:

https://www.suse.com/security/cve/CVE-2025-3063.html
https://www.suse.com/security/cve/CVE-2026-3061.html
https://www.suse.com/security/cve/CVE-2026-3062.html
https://bugzilla.suse.com/1258733



SUSE-SU-2026:0611-1: important: Security update for MozillaFirefox


# Security update for MozillaFirefox

Announcement ID: SUSE-SU-2026:0611-1
Release Date: 2026-02-24T14:47:36Z
Rating: important
References:

* bsc#1258231

Cross-References:

* CVE-2026-2447

CVSS scores:

* CVE-2026-2447 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-2447 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2447 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

* Desktop Applications Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves one vulnerability can now be installed.

## Description:

This update for MozillaFirefox fixes the following issues:

* Update to Firefox 140.7.1 ESR
* CVE-2026-2447: Fixed a heap buffer overflow in libvpx. (bsc#1258231)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-611=1

* Desktop Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-611=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-611=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-611=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-611=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-611=1

* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-611=1

* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-611=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-611=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-611=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-611=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-611=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-branding-upstream-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* openSUSE Leap 15.6 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* Desktop Applications Module 15-SP7 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* MozillaFirefox-translations-common-140.7.1-150200.152.219.1
* MozillaFirefox-debuginfo-140.7.1-150200.152.219.1
* MozillaFirefox-translations-other-140.7.1-150200.152.219.1
* MozillaFirefox-140.7.1-150200.152.219.1
* MozillaFirefox-debugsource-140.7.1-150200.152.219.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* MozillaFirefox-devel-140.7.1-150200.152.219.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2447.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258231



SUSE-SU-2026:0621-1: important: Security update for freerdp


# Security update for freerdp

Announcement ID: SUSE-SU-2026:0621-1
Release Date: 2026-02-24T16:37:58Z
Rating: important
References:

* bsc#1257981
* bsc#1257982
* bsc#1257983
* bsc#1257986
* bsc#1257988
* bsc#1257989
* bsc#1257991

Cross-References:

* CVE-2026-24491
* CVE-2026-24675
* CVE-2026-24676
* CVE-2026-24679
* CVE-2026-24681
* CVE-2026-24682
* CVE-2026-24684

CVSS scores:

* CVE-2026-24491 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24491 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24491 ( NVD ): 7.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24491 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-24675 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24675 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24675 ( NVD ): 7.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24675 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-24676 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24676 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24676 ( NVD ): 7.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24676 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-24679 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24679 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24679 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24679 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
* CVE-2026-24681 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24681 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24681 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24681 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-24682 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24682 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24682 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24682 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-24684 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24684 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24684 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-24684 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* openSUSE Leap 15.4
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves seven vulnerabilities can now be installed.

## Description:

This update for freerdp fixes the following issues:

* CVE-2026-24491: heap-use-after-free in video_timer (bsc#1257981).
* CVE-2026-24675: heap-use-after-free in urb_select_interface (bsc#1257982).
* CVE-2026-24676: heap-use-after-free in audio_format_compatible
(bsc#1257983).
* CVE-2026-24679: heap-buffer-overflow in urb_select_interface (bsc#1257986).
* CVE-2026-24681: heap-use-after-free in urb_bulk_transfer_cb (bsc#1257988).
* CVE-2026-24682: heap-buffer-overflow in audio_formats_free (bsc#1257989).
* CVE-2026-24684: heap-use-after-free in play_thread (bsc#1257991).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-621=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-621=1

## Package List:

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* libuwac0-0-2.4.0-150400.3.38.1
* freerdp-proxy-debuginfo-2.4.0-150400.3.38.1
* freerdp-proxy-2.4.0-150400.3.38.1
* libuwac0-0-debuginfo-2.4.0-150400.3.38.1
* freerdp-2.4.0-150400.3.38.1
* libfreerdp2-2.4.0-150400.3.38.1
* uwac0-0-devel-2.4.0-150400.3.38.1
* libfreerdp2-debuginfo-2.4.0-150400.3.38.1
* freerdp-devel-2.4.0-150400.3.38.1
* winpr2-devel-2.4.0-150400.3.38.1
* libwinpr2-debuginfo-2.4.0-150400.3.38.1
* libwinpr2-2.4.0-150400.3.38.1
* freerdp-wayland-debuginfo-2.4.0-150400.3.38.1
* freerdp-server-2.4.0-150400.3.38.1
* freerdp-debuginfo-2.4.0-150400.3.38.1
* freerdp-server-debuginfo-2.4.0-150400.3.38.1
* freerdp-wayland-2.4.0-150400.3.38.1
* freerdp-debugsource-2.4.0-150400.3.38.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* libwinpr2-debuginfo-2.4.0-150400.3.38.1
* libwinpr2-2.4.0-150400.3.38.1
* freerdp-debuginfo-2.4.0-150400.3.38.1
* libfreerdp2-debuginfo-2.4.0-150400.3.38.1
* libfreerdp2-2.4.0-150400.3.38.1
* freerdp-debugsource-2.4.0-150400.3.38.1

## References:

* https://www.suse.com/security/cve/CVE-2026-24491.html
* https://www.suse.com/security/cve/CVE-2026-24675.html
* https://www.suse.com/security/cve/CVE-2026-24676.html
* https://www.suse.com/security/cve/CVE-2026-24679.html
* https://www.suse.com/security/cve/CVE-2026-24681.html
* https://www.suse.com/security/cve/CVE-2026-24682.html
* https://www.suse.com/security/cve/CVE-2026-24684.html
* https://bugzilla.suse.com/show_bug.cgi?id=1257981
* https://bugzilla.suse.com/show_bug.cgi?id=1257982
* https://bugzilla.suse.com/show_bug.cgi?id=1257983
* https://bugzilla.suse.com/show_bug.cgi?id=1257986
* https://bugzilla.suse.com/show_bug.cgi?id=1257988
* https://bugzilla.suse.com/show_bug.cgi?id=1257989
* https://bugzilla.suse.com/show_bug.cgi?id=1257991



openSUSE-SU-2026:10247-1: moderate: python311-Django4-4.2.28-1.1 on GA media


# python311-Django4-4.2.28-1.1 on GA media

Announcement ID: openSUSE-SU-2026:10247-1
Rating: moderate

Cross-References:

* CVE-2025-13473
* CVE-2025-14550
* CVE-2026-1207
* CVE-2026-1285
* CVE-2026-1287
* CVE-2026-1312

CVSS scores:

* CVE-2025-13473 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-14550 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-1207 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-1285 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-1287 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-1312 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* openSUSE Tumbleweed

An update that solves 6 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the python311-Django4-4.2.28-1.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* python311-Django4 4.2.28-1.1
* python312-Django4 4.2.28-1.1
* python313-Django4 4.2.28-1.1

## References:

* https://www.suse.com/security/cve/CVE-2025-13473.html
* https://www.suse.com/security/cve/CVE-2025-14550.html
* https://www.suse.com/security/cve/CVE-2026-1207.html
* https://www.suse.com/security/cve/CVE-2026-1285.html
* https://www.suse.com/security/cve/CVE-2026-1287.html
* https://www.suse.com/security/cve/CVE-2026-1312.html



openSUSE-SU-2026:10243-1: moderate: freerdp2-2.11.7-5.1 on GA media


# freerdp2-2.11.7-5.1 on GA media

Announcement ID: openSUSE-SU-2026:10243-1
Rating: moderate

Cross-References:

* CVE-2026-24491
* CVE-2026-24675
* CVE-2026-24676
* CVE-2026-24679
* CVE-2026-24681
* CVE-2026-24682
* CVE-2026-24683
* CVE-2026-24684

CVSS scores:

* CVE-2026-24491 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24491 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24675 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24675 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24676 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24676 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24679 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24679 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24681 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24681 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24682 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24682 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24683 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24683 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24684 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-24684 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Products:

* openSUSE Tumbleweed

An update that solves 8 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the freerdp2-2.11.7-5.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* freerdp2 2.11.7-5.1
* freerdp2-devel 2.11.7-5.1
* freerdp2-proxy 2.11.7-5.1
* freerdp2-server 2.11.7-5.1
* libfreerdp2-2 2.11.7-5.1
* libwinpr2-2 2.11.7-5.1
* winpr2-devel 2.11.7-5.1

## References:

* https://www.suse.com/security/cve/CVE-2026-24491.html
* https://www.suse.com/security/cve/CVE-2026-24675.html
* https://www.suse.com/security/cve/CVE-2026-24676.html
* https://www.suse.com/security/cve/CVE-2026-24679.html
* https://www.suse.com/security/cve/CVE-2026-24681.html
* https://www.suse.com/security/cve/CVE-2026-24682.html
* https://www.suse.com/security/cve/CVE-2026-24683.html
* https://www.suse.com/security/cve/CVE-2026-24684.html



openSUSE-SU-2026:10241-1: moderate: cacti-1.2.30+git231.bca15e70c-1.1 on GA media


# cacti-1.2.30+git231.bca15e70c-1.1 on GA media

Announcement ID: openSUSE-SU-2026:10241-1
Rating: moderate

Cross-References:

* CVE-2026-1513
* CVE-2026-22802

Affected Products:

* openSUSE Tumbleweed

An update that solves 2 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the cacti-1.2.30+git231.bca15e70c-1.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* cacti 1.2.30+git231.bca15e70c-1.1

## References:

* https://www.suse.com/security/cve/CVE-2026-1513.html
* https://www.suse.com/security/cve/CVE-2026-22802.html



openSUSE-SU-2026:10246-1: moderate: libsoup-2_4-1-2.74.3-17.1 on GA media


# libsoup-2_4-1-2.74.3-17.1 on GA media

Announcement ID: openSUSE-SU-2026:10246-1
Rating: moderate

Cross-References:

* CVE-2026-2708

CVSS scores:

* CVE-2026-2708 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
* CVE-2026-2708 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products:

* openSUSE Tumbleweed

An update that solves one vulnerability can now be installed.

## Description:

These are all security issues fixed in the libsoup-2_4-1-2.74.3-17.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* libsoup-2_4-1 2.74.3-17.1
* libsoup-2_4-1-32bit 2.74.3-17.1
* libsoup2-devel 2.74.3-17.1
* libsoup2-devel-32bit 2.74.3-17.1
* libsoup2-lang 2.74.3-17.1
* typelib-1_0-Soup-2_4 2.74.3-17.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2708.html



openSUSE-SU-2026:10242-1: moderate: firefox-esr-140.8.0-1.1 on GA media


# firefox-esr-140.8.0-1.1 on GA media

Announcement ID: openSUSE-SU-2026:10242-1
Rating: moderate

Cross-References:

* CVE-2026-2757
* CVE-2026-2758
* CVE-2026-2759
* CVE-2026-2760
* CVE-2026-2761
* CVE-2026-2762
* CVE-2026-2763
* CVE-2026-2764
* CVE-2026-2765
* CVE-2026-2766
* CVE-2026-2767
* CVE-2026-2768
* CVE-2026-2769
* CVE-2026-2770
* CVE-2026-2771
* CVE-2026-2772
* CVE-2026-2773
* CVE-2026-2774
* CVE-2026-2775
* CVE-2026-2776
* CVE-2026-2777
* CVE-2026-2778
* CVE-2026-2779
* CVE-2026-2780
* CVE-2026-2781
* CVE-2026-2782
* CVE-2026-2783
* CVE-2026-2784
* CVE-2026-2785
* CVE-2026-2786
* CVE-2026-2787
* CVE-2026-2788
* CVE-2026-2789
* CVE-2026-2790
* CVE-2026-2791
* CVE-2026-2792
* CVE-2026-2793

CVSS scores:

* CVE-2026-2757 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2760 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2761 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2762 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2768 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2769 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2775 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-2776 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2777 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2778 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2779 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2780 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2781 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2782 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2783 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-2784 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2785 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2786 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2787 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2788 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2789 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2790 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-2791 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-2792 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

* openSUSE Tumbleweed

An update that solves 37 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the firefox-esr-140.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* firefox-esr 140.8.0-1.1
* firefox-esr-branding-upstream 140.8.0-1.1
* firefox-esr-translations-common 140.8.0-1.1
* firefox-esr-translations-other 140.8.0-1.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2757.html
* https://www.suse.com/security/cve/CVE-2026-2758.html
* https://www.suse.com/security/cve/CVE-2026-2759.html
* https://www.suse.com/security/cve/CVE-2026-2760.html
* https://www.suse.com/security/cve/CVE-2026-2761.html
* https://www.suse.com/security/cve/CVE-2026-2762.html
* https://www.suse.com/security/cve/CVE-2026-2763.html
* https://www.suse.com/security/cve/CVE-2026-2764.html
* https://www.suse.com/security/cve/CVE-2026-2765.html
* https://www.suse.com/security/cve/CVE-2026-2766.html
* https://www.suse.com/security/cve/CVE-2026-2767.html
* https://www.suse.com/security/cve/CVE-2026-2768.html
* https://www.suse.com/security/cve/CVE-2026-2769.html
* https://www.suse.com/security/cve/CVE-2026-2770.html
* https://www.suse.com/security/cve/CVE-2026-2771.html
* https://www.suse.com/security/cve/CVE-2026-2772.html
* https://www.suse.com/security/cve/CVE-2026-2773.html
* https://www.suse.com/security/cve/CVE-2026-2774.html
* https://www.suse.com/security/cve/CVE-2026-2775.html
* https://www.suse.com/security/cve/CVE-2026-2776.html
* https://www.suse.com/security/cve/CVE-2026-2777.html
* https://www.suse.com/security/cve/CVE-2026-2778.html
* https://www.suse.com/security/cve/CVE-2026-2779.html
* https://www.suse.com/security/cve/CVE-2026-2780.html
* https://www.suse.com/security/cve/CVE-2026-2781.html
* https://www.suse.com/security/cve/CVE-2026-2782.html
* https://www.suse.com/security/cve/CVE-2026-2783.html
* https://www.suse.com/security/cve/CVE-2026-2784.html
* https://www.suse.com/security/cve/CVE-2026-2785.html
* https://www.suse.com/security/cve/CVE-2026-2786.html
* https://www.suse.com/security/cve/CVE-2026-2787.html
* https://www.suse.com/security/cve/CVE-2026-2788.html
* https://www.suse.com/security/cve/CVE-2026-2789.html
* https://www.suse.com/security/cve/CVE-2026-2790.html
* https://www.suse.com/security/cve/CVE-2026-2791.html
* https://www.suse.com/security/cve/CVE-2026-2792.html
* https://www.suse.com/security/cve/CVE-2026-2793.html



SUSE-SU-2026:0635-1: moderate: Security update for python-urllib3_1


# Security update for python-urllib3_1

Announcement ID: SUSE-SU-2026:0635-1
Release Date: 2026-02-25T11:12:56Z
Rating: moderate
References:

* bsc#1254866
* bsc#1254867
* bsc#1256331

Cross-References:

* CVE-2025-66418
* CVE-2025-66471
* CVE-2026-21441

CVSS scores:

* CVE-2025-66418 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-66418 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-66418 ( NVD ): 8.9
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2025-66418 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-66471 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-66471 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-66471 ( NVD ): 8.9
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2025-66471 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-21441 ( SUSE ): 2.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-21441 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-21441 ( NVD ): 8.9
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-21441 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* openSUSE Leap 15.6
* Python 3 Module 15-SP7
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves three vulnerabilities can now be installed.

## Description:

This update for python-urllib3_1 fixes the following issues:

* CVE-2025-66471: excessive resource consumption via decompression of highly
compressed data in Streaming API (bsc#1254867).
* CVE-2025-66418: resource exhaustion via unbounded number of links in the
decompression chain (bsc#1254866).
* CVE-2026-21441: excessive resource consumption during decompression of data
in HTTP redirect responses (bsc#1256331).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-635=1 SUSE-2026-635=1

* Python 3 Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-635=1

## Package List:

* openSUSE Leap 15.6 (noarch)
* python311-urllib3_1-1.26.18-150600.3.6.1
* Python 3 Module 15-SP7 (noarch)
* python311-urllib3_1-1.26.18-150600.3.6.1

## References:

* https://www.suse.com/security/cve/CVE-2025-66418.html
* https://www.suse.com/security/cve/CVE-2025-66471.html
* https://www.suse.com/security/cve/CVE-2026-21441.html
* https://bugzilla.suse.com/show_bug.cgi?id=1254866
* https://bugzilla.suse.com/show_bug.cgi?id=1254867
* https://bugzilla.suse.com/show_bug.cgi?id=1256331


Opentelemetry-Collector, Seopeo, Firefox, and more updates for RHEL

Curl, Kernel, Ceph, Protocol Buffers, MongoDB updates for Ubuntu

Windows

Linux

macOS

Community

  • SeveG
    need some help here... situationPC= Packard BellOS= win1 ...
  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...