openSUSE-SU-2026:20429-1: important: Security update for python-dynaconf
openSUSE-SU-2026:20422-1: important: Security update for chromium
openSUSE-SU-2026:20419-1: important: Security update for python-pyOpenSSL
openSUSE-SU-2026:20428-1: important: Security update for gimp
openSUSE-SU-2026:20410-1: important: Security update for exiv2
openSUSE-SU-2026:20412-1: important: Security update for salt
openSUSE-SU-2026:20421-1: moderate: Security update for python-ldap
openSUSE-SU-2026:20415-1: important: Security update for 389-ds
openSUSE-SU-2026:20414-1: important: Security update for tomcat11
openSUSE-SU-2026:20406-1: important: Security update for python-tornado6
openSUSE-SU-2026:20399-1: moderate: Security update for libsodium
openSUSE-SU-2026:20404-1: important: Security update for curl
openSUSE-SU-2026:20402-1: important: Security update for gstreamer-plugins-ugly
openSUSE-SU-2026:20403-1: important: Security update for vim
openSUSE-SU-2026:20407-1: moderate: Security update for python-orjson
openSUSE-SU-2026:20397-1: moderate: Security update for poppler
openSUSE-SU-2026:10417-1: moderate: python311-deepdiff-8.6.2-1.1 on GA media
openSUSE-SU-2026:10423-1: moderate: nginx-1.29.7-1.1 on GA media
openSUSE-SU-2026:10421-1: moderate: kea-3.0.3-1.1 on GA media
openSUSE-SU-2026:10426-1: moderate: python311-intake-2.0.9-1.1 on GA media
openSUSE-SU-2026:10422-1: moderate: libtpms-devel-0.10.2-1.1 on GA media
openSUSE-SU-2026:10419-1: moderate: rclone-1.73.3-1.1 on GA media
openSUSE-SU-2026:10420-1: moderate: amazon-cloudwatch-agent-1.300064.0-2.1 on GA media
openSUSE-SU-2026:10425-1: moderate: python311-cbor2-5.9.0-1.1 on GA media
openSUSE-SU-2026:10424-1: moderate: jupyter-bqplot-jupyterlab-0.5.46-14.1 on GA media
openSUSE-SU-2026:10418-1: moderate: python311-jsonpath-ng-1.8.0-1.1 on GA media
openSUSE-SU-2026:20429-1: important: Security update for python-dynaconf
openSUSE security update: security update for python-dynaconf
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20429-1
Rating: important
References:
* bsc#1260063
Cross-References:
* CVE-2026-33154
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has one bug fix can now be installed.
Description:
This update for python-dynaconf fixes the following issues:
Changes in python-dynaconf:
- CVE-2026-33154: Server-Side Template Injection in the @Jinja resolver (bsc#1260063)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-packagehub-181=1
Package List:
- openSUSE Leap 16.0:
python313-dynaconf-3.2.5-bp160.2.1
References:
* https://www.suse.com/security/cve/CVE-2026-33154.html
openSUSE-SU-2026:20422-1: important: Security update for chromium
openSUSE security update: security update for chromium
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20422-1
Rating: important
References:
* bsc#1259964
Cross-References:
* CVE-2026-4439
* CVE-2026-4440
* CVE-2026-4441
* CVE-2026-4442
* CVE-2026-4443
* CVE-2026-4444
* CVE-2026-4445
* CVE-2026-4446
* CVE-2026-4447
* CVE-2026-4448
* CVE-2026-4449
* CVE-2026-4450
* CVE-2026-4451
* CVE-2026-4452
* CVE-2026-4453
* CVE-2026-4454
* CVE-2026-4455
* CVE-2026-4456
* CVE-2026-4457
* CVE-2026-4458
* CVE-2026-4459
* CVE-2026-4460
* CVE-2026-4461
* CVE-2026-4462
* CVE-2026-4463
* CVE-2026-4464
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 26 vulnerabilities and has one bug fix can now be installed.
Description:
This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 146.0.7680.153 (boo#1259964):
* CVE-2026-4439: Out of bounds memory access in WebGL
* CVE-2026-4440: Out of bounds read and write in WebGL
* CVE-2026-4441: Use after free in Base
* CVE-2026-4442: Heap buffer overflow in CSS
* CVE-2026-4443: Heap buffer overflow in WebAudio
* CVE-2026-4444: Stack buffer overflow in WebRTC
* CVE-2026-4445: Use after free in WebRTC
* CVE-2026-4446: Use after free in WebRTC
* CVE-2026-4447: Inappropriate implementation in V8
* CVE-2026-4448: Heap buffer overflow in ANGLE
* CVE-2026-4449: Use after free in Blink
* CVE-2026-4450: Out of bounds write in V8
* CVE-2026-4451: Insufficient validation of untrusted input in Navigation
* CVE-2026-4452: Integer overflow in ANGLE
* CVE-2026-4453: Integer overflow in Dawn
* CVE-2026-4454: Use after free in Network
* CVE-2026-4455: Heap buffer overflow in PDFium
* CVE-2026-4456: Use after free in Digital Credentials API
* CVE-2026-4457: Type Confusion in V8
* CVE-2026-4458: Use after free in Extensions
* CVE-2026-4459: Out of bounds read and write in WebAudio
* CVE-2026-4460: Out of bounds read in Skia
* CVE-2026-4461: Inappropriate implementation in V8
* CVE-2026-4462: Out of bounds read in Blink
* CVE-2026-4463: Heap buffer overflow in WebRTC
* CVE-2026-4464: Integer overflow in ANGLE
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-packagehub-174=1
Package List:
- openSUSE Leap 16.0:
chromedriver-146.0.7680.153-bp160.1.1
chromium-146.0.7680.153-bp160.1.1
References:
* https://www.suse.com/security/cve/CVE-2026-4439.html
* https://www.suse.com/security/cve/CVE-2026-4440.html
* https://www.suse.com/security/cve/CVE-2026-4441.html
* https://www.suse.com/security/cve/CVE-2026-4442.html
* https://www.suse.com/security/cve/CVE-2026-4443.html
* https://www.suse.com/security/cve/CVE-2026-4444.html
* https://www.suse.com/security/cve/CVE-2026-4445.html
* https://www.suse.com/security/cve/CVE-2026-4446.html
* https://www.suse.com/security/cve/CVE-2026-4447.html
* https://www.suse.com/security/cve/CVE-2026-4448.html
* https://www.suse.com/security/cve/CVE-2026-4449.html
* https://www.suse.com/security/cve/CVE-2026-4450.html
* https://www.suse.com/security/cve/CVE-2026-4451.html
* https://www.suse.com/security/cve/CVE-2026-4452.html
* https://www.suse.com/security/cve/CVE-2026-4453.html
* https://www.suse.com/security/cve/CVE-2026-4454.html
* https://www.suse.com/security/cve/CVE-2026-4455.html
* https://www.suse.com/security/cve/CVE-2026-4456.html
* https://www.suse.com/security/cve/CVE-2026-4457.html
* https://www.suse.com/security/cve/CVE-2026-4458.html
* https://www.suse.com/security/cve/CVE-2026-4459.html
* https://www.suse.com/security/cve/CVE-2026-4460.html
* https://www.suse.com/security/cve/CVE-2026-4461.html
* https://www.suse.com/security/cve/CVE-2026-4462.html
* https://www.suse.com/security/cve/CVE-2026-4463.html
* https://www.suse.com/security/cve/CVE-2026-4464.html
openSUSE-SU-2026:20419-1: important: Security update for python-pyOpenSSL
openSUSE security update: security update for python-pyopenssl
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20419-1
Rating: important
References:
* bsc#1259804
* bsc#1259808
Cross-References:
* CVE-2026-27448
* CVE-2026-27459
CVSS scores:
* CVE-2026-27448 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-27448 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-27459 ( SUSE ): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
* CVE-2026-27459 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for python-pyOpenSSL fixes the following issues:
- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804).
- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-439=1
Package List:
- openSUSE Leap 16.0:
python313-pyOpenSSL-25.0.0-160000.3.1
References:
* https://www.suse.com/security/cve/CVE-2026-27448.html
* https://www.suse.com/security/cve/CVE-2026-27459.html
openSUSE-SU-2026:20428-1: important: Security update for gimp
openSUSE security update: security update for gimp
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20428-1
Rating: important
References:
* bsc#1259979
* bsc#1259983
* bsc#1259984
* bsc#1259986
Cross-References:
* CVE-2026-4150
* CVE-2026-4151
* CVE-2026-4153
* CVE-2026-4154
CVSS scores:
* CVE-2026-4150 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-4150 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-4151 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-4151 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-4153 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-4153 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-4154 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-4154 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 4 vulnerabilities and has 4 bug fixes can now be installed.
Description:
This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2026-4150: Fixed PSD file parsing integer overflow vulnerability (bsc#1259979)
= CVE-2026-4151: Fixed ANI file parsing integer overflow vulnerability (bsc#1259983)
- CVE-2026-4153: Fixed PSP file parsing heap-based buffer overflow vulnerability (bsc#1259984)
- CVE-2026-4154: Fixed XPM file parsing integer overflow vulnerability (bsc#1259986)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-packagehub-180=1
Package List:
- openSUSE Leap 16.0:
gimp-3.0.8-bp160.3.1
gimp-devel-3.0.8-bp160.3.1
gimp-extension-goat-excercises-3.0.8-bp160.3.1
gimp-lang-3.0.8-bp160.3.1
gimp-plugin-aa-3.0.8-bp160.3.1
gimp-plugin-python3-3.0.8-bp160.3.1
gimp-vala-3.0.8-bp160.3.1
libgimp-3_0-0-3.0.8-bp160.3.1
libgimpui-3_0-0-3.0.8-bp160.3.1
References:
* https://www.suse.com/security/cve/CVE-2026-4150.html
* https://www.suse.com/security/cve/CVE-2026-4151.html
* https://www.suse.com/security/cve/CVE-2026-4153.html
* https://www.suse.com/security/cve/CVE-2026-4154.html
openSUSE-SU-2026:20410-1: important: Security update for exiv2
openSUSE security update: security update for exiv2
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20410-1
Rating: important
References:
* bsc#1219870
* bsc#1219871
* bsc#1227528
* bsc#1237347
* bsc#1248962
* bsc#1248963
* bsc#1259083
* bsc#1259084
* bsc#1259085
Cross-References:
* CVE-2024-24826
* CVE-2024-25112
* CVE-2024-39695
* CVE-2025-26623
* CVE-2025-54080
* CVE-2025-55304
* CVE-2026-25884
* CVE-2026-27596
* CVE-2026-27631
CVSS scores:
* CVE-2024-24826 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-25112 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-39695 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
* CVE-2025-26623 ( SUSE ): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-26623 ( SUSE ): 7.1 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-54080 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2025-54080 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-55304 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-55304 ( SUSE ): 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-25884 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
* CVE-2026-25884 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27596 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-27596 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27631 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-27631 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 9 vulnerabilities and has 9 bug fixes can now be installed.
Description:
This update for exiv2 fixes the following issues:
Update to exiv2 0.28.8:
- CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).
- CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).
- CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).
- CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).
- CVE-2025-54080: out-of-bounds read in `Exiv2: EpsImage: writeMetadata()` when writing metadata into a crafted image
file (bsc#1248962).
- CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of `JpegBase: readMetadata`
(bsc#1248963).
- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).
- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).
- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`
(bsc#1259085).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-424=1
Package List:
- openSUSE Leap 16.0:
exiv2-0.28.8-160000.1.1
exiv2-lang-0.28.8-160000.1.1
libexiv2-28-0.28.8-160000.1.1
libexiv2-28-x86-64-v3-0.28.8-160000.1.1
libexiv2-devel-0.28.8-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2024-24826.html
* https://www.suse.com/security/cve/CVE-2024-25112.html
* https://www.suse.com/security/cve/CVE-2024-39695.html
* https://www.suse.com/security/cve/CVE-2025-26623.html
* https://www.suse.com/security/cve/CVE-2025-54080.html
* https://www.suse.com/security/cve/CVE-2025-55304.html
* https://www.suse.com/security/cve/CVE-2026-25884.html
* https://www.suse.com/security/cve/CVE-2026-27596.html
* https://www.suse.com/security/cve/CVE-2026-27631.html
openSUSE-SU-2026:20412-1: important: Security update for salt
openSUSE security update: security update for salt
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20412-1
Rating: important
References:
* bsc#1240532
* bsc#1246130
* bsc#1254325
* bsc#1254903
* bsc#1254904
* bsc#1254905
Cross-References:
* CVE-2025-13836
* CVE-2025-67724
* CVE-2025-67725
* CVE-2025-67726
CVSS scores:
* CVE-2025-13836 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2025-13836 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2025-67724 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-67724 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-67725 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-67725 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-67726 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-67726 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 4 vulnerabilities and has 6 bug fixes can now be installed.
Description:
This update for salt fixes the following issues:
Changes in salt:
- Security issues fixed:
* CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
* CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
* CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
- Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
- Use internal deb classes instead of external aptsource lib
- Improved performance of wheel key.finger call (bsc#1240532)
- Improved performance of utils.find_json function (bsc#1246130)
- Extend warn_until period to 2027
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-430=1
Package List:
- openSUSE Leap 16.0:
python313-salt-3006.0-160000.4.1
python313-salt-testsuite-3006.0-160000.4.1
salt-3006.0-160000.4.1
salt-api-3006.0-160000.4.1
salt-bash-completion-3006.0-160000.4.1
salt-cloud-3006.0-160000.4.1
salt-doc-3006.0-160000.4.1
salt-fish-completion-3006.0-160000.4.1
salt-master-3006.0-160000.4.1
salt-minion-3006.0-160000.4.1
salt-proxy-3006.0-160000.4.1
salt-ssh-3006.0-160000.4.1
salt-standalone-formulas-configuration-3006.0-160000.4.1
salt-syndic-3006.0-160000.4.1
salt-transactional-update-3006.0-160000.4.1
salt-zsh-completion-3006.0-160000.4.1
References:
* https://www.suse.com/security/cve/CVE-2025-13836.html
* https://www.suse.com/security/cve/CVE-2025-67724.html
* https://www.suse.com/security/cve/CVE-2025-67725.html
* https://www.suse.com/security/cve/CVE-2025-67726.html
openSUSE-SU-2026:20421-1: moderate: Security update for python-ldap
openSUSE security update: security update for python-ldap
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20421-1
Rating: moderate
References:
* bsc#1251912
* bsc#1251913
Cross-References:
* CVE-2025-61911
* CVE-2025-61912
CVSS scores:
* CVE-2025-61911 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-61911 ( SUSE ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2025-61912 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-61912 ( SUSE ): 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for python-ldap fixes the following issues:
- CVE-2025-61911: Enforce str for escape_filter_chars (bsc#1251912).
- CVE-2025-61912: Escape NULs as per RFC 4514 in escape_dn_chars (bsc#1251913).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-443=1
Package List:
- openSUSE Leap 16.0:
python313-ldap-3.4.4-160000.3.1
References:
* https://www.suse.com/security/cve/CVE-2025-61911.html
* https://www.suse.com/security/cve/CVE-2025-61912.html
openSUSE-SU-2026:20415-1: important: Security update for 389-ds
openSUSE security update: security update for 389-ds
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20415-1
Rating: important
References:
* bsc#1258727
Cross-References:
* CVE-2025-14905
CVSS scores:
* CVE-2025-14905 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14905 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has one bug fix can now be installed.
Description:
This update for 389-ds fixes the following issue:
Update to 389-ds 3.0.6~git249.6688af9b2:
- CVE-2025-14905: heap buffer overflow due to improper size calculation in `schema_attr_enum_callback` can lead to DoS
and RCE (bsc#1258727).
Changelog:
* Issue 7277 - UI - Fix Japanese translation for "Successfully updated group" in Cockpit UI (#7278)
* Issue 7275 - UI - Improve password policy field validation in Cockpit UI (#7276)
* Issue 7279 - UI - Fix typo in export certificate dialog (#7280)
* Issue 7273 - In a chaining environment binding as remote user causes an invalid error in the logs
* Issue 7271 - plugins that create threads need to update active thread count
* Issue 5853 - Update concread to 0.5.10
* Issue 7053 - Remove memberof_del_dn_from_groups from MemberOf plugin (#7064)
* Issue 7223 - Remove integerOrderingMatch requirement for parentid (#7264)
* Issue 7066/7052 - allow password history to be set to zero and remove history
* Issue 7223 - Use lexicographical order for ancestorid (#7256)
* Issue 7213 - (2nd) MDB_BAD_VALSIZE error while handling VLV (#7258)
* Issue 7184 - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated (#7257)
* Issue - CLI - dsctl db2index needs some hardening with MBD
* Issue 7248 - CLI - attribute uniqueness - fix usage for exclude subtree option
* Issue 7231 - Sync repl tests fail in FIPS mode due to non FIPS compliant crypto (#7232)
* Issue 7121 - (2nd) LeakSanitizer: various leaks during replication (#7212)
* Issue 6947 - Fix health_system_indexes_test.py
* Issue 7076 - Fix revert_cache() never called in modrdn (#7220)
* Issue 7076, 6992, 6784, 6214 - Fix CI test failures (#7077)
* Issue 7096 - (2nd) During replication online total init the function idl_id_is_in_idlist is not scaling with large
database (#7205)
* Issue 3555 - UI - Fix audit issue with npm - @isaacs/brace-expansion (#7228)
* Issue 7223 - Add dsctl index-check command for offline index repair
* Issue 7223 - Detect and log index ordering mismatch during backend startup
* Issue 7223 - Add upgrade function to remove ancestorid index config entry
* Issue 7223 - Add upgrade function to remove nsIndexIDListScanLimit from parentid
* Issue 7223 - Revert index scan limits for system indexes
* Issue 6542 - RPM build errors on Fedora 42
* Issue 7224 - CI Test - Simplify test_reserve_descriptor_validation (#7225)
* Issue 7194 - Repl Log Analysis - Add CSN propagation details (#7195)
* Issue 7213 - MDB_BAD_VALSIZE error while handling VLV (#7214)
* Issue 7027 - (2nd) 389-ds-base OpenScanHub Leaks Detected (#7211)
* Issue 7184 - argparse.HelpFormatter _format_actions_usage() is deprecated
* Issue 7198 - Web console doesn't show sub-suffix when parent-suffix points to an entry (#7202)
* Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits
* Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console (#7203)
* Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180)
* Issue 7172 - Index ordering mismatch after upgrade (#7173)
* Issue - Revise paged result search locking
* Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large
database (#7145)
* Revert "Issue 7160 - Add lib389 version sync check to configure (#7165)"
* Issue 7160 - Add lib389 version sync check to configure (#7165)
* Issue 7049 - RetroCL plugin generates invalid LDIF
* Issue 7150 - Compressed access log rotations skipped, accesslog-list out of sync (#7151)
* Restore definition for slapi_entry_attr_get_valuearray
* Issue 1793 - RFE - Dynamic lists - UI and CLI updates
* Issue 7119 - Fix DNA shared config replication test (#7143)
* Issue 7081 - Repl Log Analysis - Implement data sampling with performance and timezone fixes (#7086)
* Issue 1793 - RFE - Implement dynamic lists
* Issue 6753 - Port ticket tests
* Issue 6753 - Port and fix ticket 47823 tests
* Issue 6753 - Add 'add_exclude_subtree' and 'remove_exclude_subtree' methods to Attribute uniqueness plugin
* Issue 6753 - Port ticket test 48026
* Issue 7128 - memory corruption in alias entry plugin (#7131)
* Issue 7091 - Duplicate local password policy entries listed (#7092)
* Issue 7124 - BDB cursor race condition with transaction isolation (#7125)
* Issue 7132 - Keep alive entry updated too soon after an offline import (#7133)
* Issue 7121 - LeakSanitizer: various leaks during replication (#7122)
* Issue 7115 - LeakSanitizer: leak in `slapd_bind_local_user()` (#7116)
* Issue 7109 - AddressSanitizer: SEGV ldap/servers/slapd/csnset.c:302 in csnset_dup (#7114)
* Issue 7056 - DSBLE0007 doesn't generate remediation steps for missing indexes
* Issue 7119 - Harden DNA plugin locking for shared server list operations (#7120)
* Issue 7084 - UI - schema - sorting attributes breaks expanded row
* Issue 7007 - Improve paged result search locking
* Issue 3555 - UI - Fix audit issue with npm - glob (#7107)
* Issue 6846 - Attribute uniqueness is not enforced with modrdn (#7026)
* Issue 6901 - Update changelog trimming logging - fix tests
* Issue 6901 - Update changelog trimming logging
* Bump js-yaml from 4.1.0 to 4.1.1 in /src/cockpit/389-console (#7097)
* Issue 7069 - Fix error reporting in HAProxy trusted IP parsing (#7094)
* Issue 7055 - Online initialization of consumers fails with error -23 (#7075)
* Issue 7042 - Enable global_backend_lock when memberofallbackend is enabled (#7043)
* Issue 7078 - audit json logging does not encode binary values
* Issue 7069 - Add Subnet/CIDR Support for HAProxy Trusted IPs (#7070)
* Issue 6660 - CLI, UI - Improve replication log analyzer usability (#7062)
* Issue 7065 - A search filter containing a non normalized DN assertion does not return matching entries (#7068)
* Issue 7071 - search filter (&(cn:dn:=groups)) no longer returns results
* Issue 7073 - Add NDN cache size configuration and enforcement tests (#7074)
* Issue 7041 - CLI/UI - memberOf - no way to add/remove specific group filters
* Issue 7061 - CLI/UI - Improve error messages for dsconf localpwp list
* Issue 7059 - UI - unable to upload pem file
* Issue 7032 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue (#7036)
* Issue 7047 - MemberOf plugin logs null attribute name on fixup task completion (#7048)
* Issue 7044 - RFE - index sudoHost by default (#7046)
* Issue 6979 - Improve the way to detect asynchronous operations in the access logs (#6980)
* Issue 7035 - RFE - memberOf - adding scoping for specific groups
* Issue - CLI/UI - Add option to delete all replication conflict entries
* Issue 7033 - lib389 - basic plugin status not in JSON
* Issue 7023 - UI - if first instance that is loaded is stopped it breaks parts of the UI
* Issue 7027 - 389-ds-base OpenScanHub Leaks Detected (#7028)
* Issue 6966 - On large DB, unlimited IDL scan limit reduce the SRCH performance (#6967)
* Issue 6660 - UI - Improve replication log analysis charts and usability (#6968)
* Issue 6982 - UI - MemberOf shared config does not validate DN properly (#6983)
* Issue 7021 - Units for changing MDB max size are not consistent across different tools (#7022)
* Issue 6954 - do not delete referrals on chain_on_update backend
* Issue 7018 - BUG - prevent stack depth being hit (#7019)
* Issue 6928 - The parentId attribute is indexed with improper matching rule
* Issue 6933 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup
task by default (#6935)
* Issue 6904 - Fix config_test.py::test_lmdb_config
* Issue 7014 - memberOf - ignored deferred updates with LMDB
* Issue 7012 - improve dscrl dbverify result when backend does not exists (#7013)
* Issue 6929 - Compilation failure with rust-1.89 on Fedora ELN
* Issue 6990 - UI - Replace deprecated Select components with new TypeaheadSelect (#6996)
* Issue 6990 - UI - Fix typeahead Select fields losing values on Enter keypress (#6991)
* Issue 6887 - Enhance logconv.py to add support for JSON access logs (#6889)
* Issue 6985 - Some logconv CI tests fail with BDB (#6986)
* Issue 6891 - JSON logging - add wrapper function that checks for NULL
* Issue 6977 - UI - Show error message when trying to use unavailable ports (#6978)
* Issue 6956 - More UI fixes
* Issue 6947 - Revise time skew check in healthcheck tool and add option to exclude checks
* Issue 6805 - RFE - Multiple backend entry cache tuning
* Issue 6843 - Add CI tests for logconv.py (#6856)
* Issue - UI - update Radio handlers and LDAP entries last modified time
* Issue 6660 - UI - Fix minor typo (#6955)
* Issue 6910 - Fix latest coverity issues
* Issue 6919 - numSubordinates/tombstoneNumSubordinates are inconsisten... (#6920)
* Issue 6663 - Fix NULL subsystem crash in JSON error logging (#6883)
* Issue 6940 - dsconf monitor server fails with ldapi:// due to absent server ID (#6941)
* Issue 6936 - Make user/subtree policy creation idempotent (#6937)
* Issue 6865 - AddressSanitizer: leak in agmt_update_init_status
* Issue 6848 - AddressSanitizer: leak in do_search
* Issue 6850 - AddressSanitizer: memory leak in mdb_init
* Issue 6778 - Memory leak in roles_cache_create_object_from_entry part 2
* Issue 6778 - Memory leak in roles_cache_create_object_from_entry
* Issue 6181 - RFE - Allow system to manage uid/gid at startup
* Issues 6913, 6886, 6250 - Adjust xfail marks (#6914)
* Issue 6768 - ns-slapd crashes when a referral is added (#6780)
* Issue 6468 - CLI - Fix default error log level
* Issue 6339 - Address Coverity scan issues in memberof and bdb_layer (#6353)
* Issue 6897 - Fix disk monitoring test failures and improve test maintainability (#6898)
* Issue 6884 - Mask password hashes in audit logs (#6885)
* Issue 6594 - Add test for numSubordinates replication consistency with tombstones (#6862)
* Issue 6250 - Add test for entryUSN overflow on failed add operations (#6821)
* Issue 6895 - Crash if repl keep alive entry can not be created
* Issue 6893 - Log user that is updated during password modify extended operation
* Issue 6772 - dsconf - Replicas with the "consumer" role allow for viewing and modification of their
changelog. (#6773)
* Issue 6888 - Missing access JSON logging for TLS/Client auth
* Issue 6680 - instance read-only mode is broken (#6681)
* Issue 6878 - Prevent repeated disconnect logs during shutdown (#6879)
* Issue 6872 - compressed log rotation creates files with world readable permission
* Issue 6859 - str2filter is not fully applying matching rules
* Issue 6868 - UI - schema attribute table expansion break after moving to a new page
* Issue 6854 - Refactor for improved data management (#6855)
* Issue 6756 - CLI, UI - Properly handle disabled NDN cache (#6757)
* Issue 6857 - uiduniq: allow specifying match rules in the filter
* Issue 6838 - lib389/replica.py is using nonexistent datetime.UTC in Python 3.9
* Issue 6822 - Backend creation cleanup and Database UI tab error handling (#6823)
* Issue 6782 - Improve paged result locking
* Issue 6825 - RootDN Access Control Plugin with wildcards for IP addre... (#6826)
* Issue 6736 - Exception thrown by dsconf instance repl get_ruv (#6742)
* Issue 6819 - Incorrect pwdpolicysubentry returned for an entry with user password policy
* Issue 6553 - Update concread to 0.5.6 (#6824)
* Issue 1081 - Add a CI test (#6063)
* Issue 6761 - Password modify extended operation should skip password policy checks when executed by root DN
* Issue 6791 - crash in liblmdb during instance shutdown (#6793)
* Issue 6641 - modrdn fails when a user is member of multiple groups (#6643)
* Issue 6776 - Enabling audit log makes slapd coredump
* Issue 6534 - CI fails with Fedora 41 and DNF5
* Issue 6787 - Improve error message when bulk import connection is closed
* Issue 6727 - RFE - database compaction interval should be persistent
* Issue 6438 - Add basic dsidm organizational unit tests
* Issue 6439 - Fix dsidm service get_dn option
* Issue 5120 - ns-slapd doesn't start in referral mode (#6763)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-434=1
Package List:
- openSUSE Leap 16.0:
389-ds-3.0.6~git249.6688af9b2-160000.1.1
389-ds-devel-3.0.6~git249.6688af9b2-160000.1.1
389-ds-snmp-3.0.6~git249.6688af9b2-160000.1.1
lib389-3.0.6~git249.6688af9b2-160000.1.1
libsvrcore0-3.0.6~git249.6688af9b2-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-14905.html
openSUSE-SU-2026:20414-1: important: Security update for tomcat11
openSUSE security update: security update for tomcat11
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20414-1
Rating: important
References:
* bsc#1253460
* bsc#1258371
* bsc#1258385
* bsc#1258387
Cross-References:
* CVE-2025-66614
* CVE-2026-24733
* CVE-2026-24734
CVSS scores:
* CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-24733 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 3 vulnerabilities and has 4 bug fixes can now be installed.
Description:
This update for tomcat11 fixes the following issues:
Update to Tomcat 11.0.18:
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
Changelog:
+ Fix: 69932: Fix request end access log pattern regression, which would log
the start time of the request instead. (remm)
+ Fix: 69623: Additional fix for the long standing regression that meant
that calls to ClassLoader.getResource().getContent() failed when made from
within a web application with resource caching enabled if the target
resource was packaged in a JAR file. (markt)
+ Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
+ Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
+ Update: Enable minimum and recommended Tomcat Native versions to be set
separately for Tomcat Native 1.x and 2.x. Update the minimum and
recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum
and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
+ Add: Add a new ssoReauthenticationMode to the Tomcat provided
Authenticators that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
+ Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
+ Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
+ Fix: Add log warnings for additional Host appBase suspicious values.
(remm)
+ Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
+ Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
+ Fix: Change the SSO reauthentication behaviour for SPNEGO authentication
so that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
+ Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential
NullPointerException. Identified by Coverity Scan. (markt)
+ Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
+ Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the
credential and salt are digested. By default, the current, non-RFC 3112
compliant, order of salt then credential will be used. This default will
change in Tomcat 12 to the RFC 3112 compliant order of credential then
salt. (markt)
* Cluster
+ Add: 62814: Document that human-readable names may be used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
+ Fix: Correct a regression introduced in 11.0.11 that broke some clustering
configurations. (markt)
* Coyote
+ Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown
that triggered a significant memory leak. Patch provided by Wes. (markt)
+ Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
+ Fix: Improve warnings when setting ciphers lists in the FFM code,
mirroring the tomcat-native changes. (remm)
+ Fix: 69910: Dereference TLS objects right after closing a socket to
improve memory efficiency. (remm)
+ Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the
other attributes. (markt)
+ Fix: Better warning message when OpenSSLConf configuration elements are
used with a JSSE TLS implementation. (markt)
+ Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
+ Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute
of an SSLHostConfig are now always ignored (previously they would be
ignored with OpenSSL implementations and used with JSSE implementations)
and a warning is logged that the cipher suite has been ignored. (markt)
+ Add: Add the ciphersuite attribute to SSLHostConfig to configure the
TLSv1.3 cipher suites. (markt)
+ Add: Add OCSP support to JSSE based TLS connectors and make the use of
OCSP configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those
performed by JSSE. (markt)
+ Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
+ Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
+ Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
+ Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
+ Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
+ Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The
attribute default value is true, enabling the matching. (remm)
+ Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
+ Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
+ Fix: Fix potential crash on shutdown when a Connector depends on the
Tomcat Native library. (markt)
+ Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
* Jasper
+ Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
+ Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
+ Fix: Fix populating the classpath with the webapp classloader
repositories. (remm)
+ Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
+ Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
+ Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
+ Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
+ Add: Documentation: Expand the documentation to better explain when OCSP
is supported and when it is not. (markt)
* Websocket
+ Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
* Other
+ Add: Add property "gpg.sign.files" to optionally disable release artefact
signing with GPG. (rjung)
+ Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
+ Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
+ Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
+ Update: Update Commons Daemon to 1.5.1. (markt)
+ Update: Update to the Eclipse JDT compiler 4.37. (markt)
+ Update: Update ByteBuddy to 1.18.3. (markt)
+ Update: Update UnboundID to 7.0.4. (markt)
+ Update: Update Checkstyle to 12.3.1. (markt)
+ Add: Improvements to French translations. (markt)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
+ Update: Update Tomcat Native to 2.0.12. (markt)
+ Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile= to run specific test subsets without
using patterns directly. Profile patterns are defined in
test-profiles.properties. (csutherl)
+ Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.10. (markt)
+ Update: Update Commons Daemon to 1.5.0. (markt)
+ Update: Update Byte Buddy to 1.18.2. (markt)
+ Update: Update Checkstyle to 12.2.0. (markt)
+ Add: Improvements to Spanish translations provided by White Vogel. (markt)
+ Add: Improvements to French translations. (remm)
+ Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
+ Update: Update to Byte Buddy 1.17.8. (markt)
+ Update: Update to Checkstyle 12.1.1. (markt)
+ Update: Update to Jacoco 0.8.14. (markt)
+ Update: Update to SpotBugs 4.9.8. (markt)
+ Update: Update to JSign 7.4. (markt)
+ Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-433=1
Package List:
- openSUSE Leap 16.0:
tomcat11-11.0.18-160000.1.1
tomcat11-admin-webapps-11.0.18-160000.1.1
tomcat11-doc-11.0.18-160000.1.1
tomcat11-docs-webapp-11.0.18-160000.1.1
tomcat11-el-6_0-api-11.0.18-160000.1.1
tomcat11-embed-11.0.18-160000.1.1
tomcat11-jsp-4_0-api-11.0.18-160000.1.1
tomcat11-jsvc-11.0.18-160000.1.1
tomcat11-lib-11.0.18-160000.1.1
tomcat11-servlet-6_1-api-11.0.18-160000.1.1
tomcat11-webapps-11.0.18-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-66614.html
* https://www.suse.com/security/cve/CVE-2026-24733.html
* https://www.suse.com/security/cve/CVE-2026-24734.html
openSUSE-SU-2026:20406-1: important: Security update for python-tornado6
openSUSE security update: security update for python-tornado6
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20406-1
Rating: important
References:
* bsc#1259553
* bsc#1259630
Cross-References:
* CVE-2026-31958
CVSS scores:
* CVE-2026-31958 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-31958 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has 2 bug fixes can now be installed.
Description:
This update for python-tornado6 fixes the following issues:
- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes
(bsc#1259630).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-420=1
Package List:
- openSUSE Leap 16.0:
python313-tornado6-6.5-160000.4.1
References:
* https://www.suse.com/security/cve/CVE-2026-31958.html
openSUSE-SU-2026:20399-1: moderate: Security update for libsodium
openSUSE security update: security update for libsodium
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20399-1
Rating: moderate
References:
* bsc#1256070
Cross-References:
* CVE-2025-15444
CVSS scores:
* CVE-2025-15444 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has one bug fix can now be installed.
Description:
This update for libsodium fixes the following issues:
- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-413=1
Package List:
- openSUSE Leap 16.0:
libsodium-devel-1.0.20-160000.3.1
libsodium26-1.0.20-160000.3.1
References:
* https://www.suse.com/security/cve/CVE-2025-15444.html
openSUSE-SU-2026:20404-1: important: Security update for curl
openSUSE security update: security update for curl
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20404-1
Rating: important
References:
* bsc#1259362
* bsc#1259363
* bsc#1259364
* bsc#1259365
Cross-References:
* CVE-2026-1965
* CVE-2026-3783
* CVE-2026-3784
* CVE-2026-3805
CVSS scores:
* CVE-2026-1965 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-1965 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
* CVE-2026-3783 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2026-3783 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-3784 ( SUSE ): 4.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-3784 ( SUSE ): 1 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-3805 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-3805 ( SUSE ): 2 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 4 vulnerabilities and has 4 bug fixes can now be installed.
Description:
This update for curl fixes the following issues:
- CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
- CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
- CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
- CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-418=1
Package List:
- openSUSE Leap 16.0:
curl-8.14.1-160000.5.1
curl-fish-completion-8.14.1-160000.5.1
curl-zsh-completion-8.14.1-160000.5.1
libcurl-devel-8.14.1-160000.5.1
libcurl-devel-doc-8.14.1-160000.5.1
libcurl4-8.14.1-160000.5.1
References:
* https://www.suse.com/security/cve/CVE-2026-1965.html
* https://www.suse.com/security/cve/CVE-2026-3783.html
* https://www.suse.com/security/cve/CVE-2026-3784.html
* https://www.suse.com/security/cve/CVE-2026-3805.html
openSUSE-SU-2026:20402-1: important: Security update for gstreamer-plugins-ugly
openSUSE security update: security update for gstreamer-plugins-ugly
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20402-1
Rating: important
References:
* bsc#1259367
* bsc#1259370
Cross-References:
* CVE-2026-2920
* CVE-2026-2922
CVSS scores:
* CVE-2026-2920 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2922 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for gstreamer-plugins-ugly fixes the following issues:
- CVE-2026-2920: GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1259367).
- CVE-2026-2922: GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability (bsc#1259370).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-416=1
Package List:
- openSUSE Leap 16.0:
gstreamer-plugins-ugly-1.26.7-160000.2.1
gstreamer-plugins-ugly-lang-1.26.7-160000.2.1
References:
* https://www.suse.com/security/cve/CVE-2026-2920.html
* https://www.suse.com/security/cve/CVE-2026-2922.html
openSUSE-SU-2026:20403-1: important: Security update for vim
openSUSE security update: security update for vim
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20403-1
Rating: important
References:
* bsc#1246602
* bsc#1258229
* bsc#1259051
Cross-References:
* CVE-2025-53906
* CVE-2026-26269
* CVE-2026-28417
CVSS scores:
* CVE-2025-53906 ( SUSE ): 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
* CVE-2025-53906 ( SUSE ): 1.8 CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
* CVE-2026-26269 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
* CVE-2026-28417 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-28417 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.
Description:
This update for vim fixes the following issues:
- Update Vim to version 9.2.0110 that includes security fixes for:
* CVE-2026-28417: crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
* CVE-2026-26269: stack buffer overflow in Vim's NetBeans integration when processing the specialKeys command (bsc#1258229).
* CVE-2025-53906: path traversal in Vim's zip.vim plugin (bsc#1246602).
- Other changes:
* Add wayland-client to BuildRequires and enable Wayland support.
* Add Wayland include path to CFLAGS to fix clipboard compilation.
* Package new Swedish (sv) man pages and clean up duplicate encodings (sv.ISO8859-1 and sv.UTF-8).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-417=1
Package List:
- openSUSE Leap 16.0:
gvim-9.2.0110-160000.1.1
vim-9.2.0110-160000.1.1
vim-data-9.2.0110-160000.1.1
vim-data-common-9.2.0110-160000.1.1
vim-small-9.2.0110-160000.1.1
xxd-9.2.0110-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-53906.html
* https://www.suse.com/security/cve/CVE-2026-26269.html
* https://www.suse.com/security/cve/CVE-2026-28417.html
openSUSE-SU-2026:20407-1: moderate: Security update for python-orjson
openSUSE security update: security update for python-orjson
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20407-1
Rating: moderate
References:
* bsc#1257121
Cross-References:
* CVE-2025-67221
CVSS scores:
* CVE-2025-67221 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-67221 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has one bug fix can now be installed.
Description:
This update for python-orjson fixes the following issues:
- CVE-2025-67221: Fixed write outsize of allocated memory on json dump (bsc#1257121).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-421=1
Package List:
- openSUSE Leap 16.0:
python313-orjson-3.10.15-160000.3.1
References:
* https://www.suse.com/security/cve/CVE-2025-67221.html
openSUSE-SU-2026:20397-1: moderate: Security update for poppler
openSUSE security update: security update for poppler
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20397-1
Rating: moderate
References:
* bsc#1252337
Cross-References:
* CVE-2025-11896
CVSS scores:
* CVE-2025-11896 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-11896 ( SUSE ): 2 CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has one bug fix can now be installed.
Description:
This update for poppler fixes the following issues:
- CVE-2025-11896: infinite recursion leading to stack overflow due to object loop in PDF CMap (bsc#1252337).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-411=1
Package List:
- openSUSE Leap 16.0:
libpoppler-cpp2-25.04.0-160000.4.1
libpoppler-devel-25.04.0-160000.4.1
libpoppler-glib-devel-25.04.0-160000.4.1
libpoppler-glib8-25.04.0-160000.4.1
libpoppler-qt5-1-25.04.0-160000.4.1
libpoppler-qt5-devel-25.04.0-160000.4.1
libpoppler-qt6-3-25.04.0-160000.4.1
libpoppler-qt6-devel-25.04.0-160000.4.1
libpoppler148-25.04.0-160000.4.1
poppler-tools-25.04.0-160000.4.1
typelib-1_0-Poppler-0_18-25.04.0-160000.4.1
References:
* https://www.suse.com/security/cve/CVE-2025-11896.html
openSUSE-SU-2026:10417-1: moderate: python311-deepdiff-8.6.2-1.1 on GA media
# python311-deepdiff-8.6.2-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10417-1
Rating: moderate
Cross-References:
* CVE-2026-33155
CVSS scores:
* CVE-2026-33155 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33155 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-deepdiff-8.6.2-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-deepdiff 8.6.2-1.1
* python313-deepdiff 8.6.2-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33155.html
openSUSE-SU-2026:10423-1: moderate: nginx-1.29.7-1.1 on GA media
# nginx-1.29.7-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10423-1
Rating: moderate
Cross-References:
* CVE-2026-27651
* CVE-2026-27654
* CVE-2026-27784
* CVE-2026-28753
* CVE-2026-28755
* CVE-2026-32647
CVSS scores:
* CVE-2026-27651 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27651 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27654 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-27654 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27784 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-27784 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-28753 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-28753 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-28755 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-28755 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-32647 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-32647 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 6 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the nginx-1.29.7-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* nginx 1.29.7-1.1
* nginx-source 1.29.7-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-27651.html
* https://www.suse.com/security/cve/CVE-2026-27654.html
* https://www.suse.com/security/cve/CVE-2026-27784.html
* https://www.suse.com/security/cve/CVE-2026-28753.html
* https://www.suse.com/security/cve/CVE-2026-28755.html
* https://www.suse.com/security/cve/CVE-2026-32647.html
openSUSE-SU-2026:10421-1: moderate: kea-3.0.3-1.1 on GA media
# kea-3.0.3-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10421-1
Rating: moderate
Cross-References:
* CVE-2026-3608
CVSS scores:
* CVE-2026-3608 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-3608 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the kea-3.0.3-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* kea 3.0.3-1.1
* kea-devel 3.0.3-1.1
* kea-doc 3.0.3-1.1
* kea-hooks 3.0.3-1.1
* libkea-asiodns62 3.0.3-1.1
* libkea-asiolink88 3.0.3-1.1
* libkea-cc83 3.0.3-1.1
* libkea-cfgrpt3 3.0.3-1.1
* libkea-config84 3.0.3-1.1
* libkea-cryptolink64 3.0.3-1.1
* libkea-d2srv63 3.0.3-1.1
* libkea-database76 3.0.3-1.1
* libkea-dhcp109 3.0.3-1.1
* libkea-dhcp_ddns68 3.0.3-1.1
* libkea-dhcpsrv131 3.0.3-1.1
* libkea-dns71 3.0.3-1.1
* libkea-eval84 3.0.3-1.1
* libkea-exceptions45 3.0.3-1.1
* libkea-hooks121 3.0.3-1.1
* libkea-http87 3.0.3-1.1
* libkea-log-interprocess3 3.0.3-1.1
* libkea-log75 3.0.3-1.1
* libkea-mysql88 3.0.3-1.1
* libkea-pgsql88 3.0.3-1.1
* libkea-process91 3.0.3-1.1
* libkea-stats53 3.0.3-1.1
* libkea-tcp33 3.0.3-1.1
* libkea-util-io12 3.0.3-1.1
* libkea-util102 3.0.3-1.1
* python3-kea 3.0.3-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-3608.html
openSUSE-SU-2026:10426-1: moderate: python311-intake-2.0.9-1.1 on GA media
# python311-intake-2.0.9-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10426-1
Rating: moderate
Cross-References:
* CVE-2026-33310
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-intake-2.0.9-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-intake 2.0.9-1.1
* python313-intake 2.0.9-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33310.html
openSUSE-SU-2026:10422-1: moderate: libtpms-devel-0.10.2-1.1 on GA media
# libtpms-devel-0.10.2-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10422-1
Rating: moderate
Cross-References:
* CVE-2026-21444
CVSS scores:
* CVE-2026-21444 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-21444 ( SUSE ): 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the libtpms-devel-0.10.2-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* libtpms-devel 0.10.2-1.1
* libtpms0 0.10.2-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-21444.html
openSUSE-SU-2026:10419-1: moderate: rclone-1.73.3-1.1 on GA media
# rclone-1.73.3-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10419-1
Rating: moderate
Cross-References:
* CVE-2026-33186
CVSS scores:
* CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the rclone-1.73.3-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* rclone 1.73.3-1.1
* rclone-bash-completion 1.73.3-1.1
* rclone-zsh-completion 1.73.3-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33186.html
openSUSE-SU-2026:10420-1: moderate: amazon-cloudwatch-agent-1.300064.0-2.1 on GA media
# amazon-cloudwatch-agent-1.300064.0-2.1 on GA media
Announcement ID: openSUSE-SU-2026:10420-1
Rating: moderate
Cross-References:
* CVE-2026-33186
CVSS scores:
* CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the amazon-cloudwatch-agent-1.300064.0-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* amazon-cloudwatch-agent 1.300064.0-2.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33186.html
openSUSE-SU-2026:10425-1: moderate: python311-cbor2-5.9.0-1.1 on GA media
# python311-cbor2-5.9.0-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10425-1
Rating: moderate
Cross-References:
* CVE-2026-26209
CVSS scores:
* CVE-2026-26209 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-26209 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-cbor2-5.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-cbor2 5.9.0-1.1
* python313-cbor2 5.9.0-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-26209.html
openSUSE-SU-2026:10424-1: moderate: jupyter-bqplot-jupyterlab-0.5.46-14.1 on GA media
# jupyter-bqplot-jupyterlab-0.5.46-14.1 on GA media
Announcement ID: openSUSE-SU-2026:10424-1
Rating: moderate
Cross-References:
* CVE-2026-25547
* CVE-2026-27601
CVSS scores:
* CVE-2026-25547 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-25547 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27601 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-27601 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 2 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the jupyter-bqplot-jupyterlab-0.5.46-14.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* jupyter-bqplot-jupyterlab 0.5.46-14.1
* jupyter-bqplot-notebook 0.5.46-14.1
* python311-bqplot 0.12.45-14.1
## References:
* https://www.suse.com/security/cve/CVE-2026-25547.html
* https://www.suse.com/security/cve/CVE-2026-27601.html
openSUSE-SU-2026:10418-1: moderate: python311-jsonpath-ng-1.8.0-1.1 on GA media
# python311-jsonpath-ng-1.8.0-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10418-1
Rating: moderate
Cross-References:
* CVE-2025-56005
CVSS scores:
* CVE-2025-56005 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-56005 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-jsonpath-ng-1.8.0-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-jsonpath-ng 1.8.0-1.1
* python313-jsonpath-ng 1.8.0-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-56005.html
