This update for google-osconfig-agent fixes the following issue:
- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass
repeat index validation and cause a process crash (bsc#1283672).
Changes for google-osconfig-agent:
- Update to version 20260928.01
* scalibr linux new metadata support (#1038)
* Fix failing to report REBOOTING state during postPatchReboot
due to context canceled for Windows VMs (#1055)
* Fix os/snap extractor usage (#1053)
- Update github.com/klauspost/compress to v1.18.7
(bsc#1283672, CVE-2026-63209)
* bump grpc package to new version (#1057)
* bump
This update for google-osconfig-agent fixes the following issues:
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS
via oversized inputs (bsc#1276722).
- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
Changes for google-osconfig-agent:
- Update to version 20260911.00
* Add support for all possible SCALIBR os extractor for linux (#1052)
This update for google-osconfig-agent fixes the following issues:
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of
This update for google-osconfig-agent fixes the following issues
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1272118).
This update for google-osconfig-agent fixes the following issues
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents
(bsc#1251453).
- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially
crafted input (bsc#1251704).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260264).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 t
This update for google-osconfig-agent fixes the following issues:
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
This update for google-osconfig-agent fixes the following issues:
Update to version 20250416.02 (bsc#1244304, bsc#1244503)
* defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)
* Add output of some packagemanagers to the testdata (#808)
From version 20250416.01:
* Refactor OS Info package (#809)
From version 20250416.00:
* Report RPM inventory as YUM instead of empty SoftwarePackage
when neither Zypper nor YUM are installed. (#805)
From version 20250414.00:
* Update hash computation algorithm (#799)
Update to version 20250320.00:
* Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1