This update for google-osconfig-agent fixes the following issues:
- CVE-2026-61801: github.com/moby/sys/user: unbounded parsing of user and group database files can lead to denial of
service (bsc#1284870).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285283).
- CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time
complexity in unpack handler and can lead to DoS (bsc#1285135).
Changes for google-osconfig-agent:
- Update to version 20261015.00
* Add scalibr os benchmarks (#1044)
This update for google-osconfig-agent fixes the following issue:
- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass
repeat index validation and cause a process crash (bsc#1283672).
Changes for google-osconfig-agent:
- Update to version 20260928.01
* scalibr linux new metadata support (#1038)
* Fix failing to report REBOOTING state during postPatchReboot
due to context canceled for Windows VMs (#1055)
* Fix os/snap extractor usage (#1053)
* bump grpc package to new version (#1057)
* bump some dependencies across few modules (#1056)
This update for google-osconfig-agent fixes the following issues:
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS
via oversized inputs (bsc#1276722).
- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
Changes for google-osconfig-agent:
- Update to version 20260911.00
* Add support for all possible SCALIBR os extractor for linux (#1052)
This update for google-osconfig-agent fixes the following issue:
- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the
crypto/ssh library (bsc#1278597).
This update for google-osconfig-agent fixes the following issues:
This update for google-osconfig-agent fixes the following issues:
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization
policies via mixed-case or canonical-case header matches (bsc#1279297).
- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host'
This update for google-osconfig-agent fixes the following issues
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1272118).
This update for google-osconfig-agent fixes the following issues
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents
(bsc#1251453).
- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially
crafted input (bsc#1251704).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260264).
- CVE-2026-33814: golang.org/x/net/http2: infinite lo