SUSE-SU-2026:24282-1

SUSE-SU-2026:24282-1 · Security update for helm

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758). - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939). - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935). - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938). - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327). - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024). - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104). - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468). - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514). Changes for helm: - update to 4.3.0: * feat: Add duration functions * feat(engine): add debug logging when lookup returns empty * feat: add ownership verification before deleting resources * feat: honor SOURCE_DATE_EPOCH for chart archives * feat(rollback): add --description flag to provide rollback reason * fix (internal/plugin): remove zero-width spaces from plugin name comment * fix(loader): do not drop values files ending at a 4096-byte boundary * fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings * fix(template): regression - route registry messages to stderr in template and show * refactor: lower resync period from one hour to 3 minutes * perf: enable concurrent status computation to prevent multi-minute delays * fix: Improve error reporting for helm template --debug with --show-only- #31185 * fix: fetch logs from all containers in test pods- #32099 * fix(provenance): check error return in Digest and encodeRelease- #32136 * fix panic on repeated IsReachable calls- #32184 * fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 * Fix missing conflict retry with server-side apply- #32088 * Properly format the extra field in gzipped packages- #31884 * Fix vanishing empty lines- #32327 * fix: pass registry client to downloader.Manager in upgrade- #32400 * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- #32450 * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe) * bump golang.org/x/text to v.0.40.0 * Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214 * Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925 * Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056 * Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757 * Fixed a race condition in WaitForDelete where the status failures when running a full test suite #32081 #32153 * Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128 * Dependency updates * Bump to version v4.2 0646808 (George Jenkins) * build: Clean up Goreleaser change (#32098) e23bf3a (Scott Rigby) * fix: add -extldflags -static to dist target to match build-cross f60ab7c (Terry Howe) * build: use goreleaser build with manual archive creation 64aa46f (Terry Howe) * chore: remove build-cross dependency from test-acceptance d199a1a (Terry Howe) * ci: add fetch-depth 0 to canary checkout for goreleaser 8289940 * fix: address goreleaser build issues flagged in review c075022 (Terry Howe) * fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd (Terry Howe) * fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce (Terry Howe) * fix: use index for optional env var in version_template e49a1dc * fix: canary build file names eaa0910 (Terry Howe) * Fix archive name 5a75279 (Terry Howe) * fix goreleaser archive 37284a9 (Terry Howe) * add support for loong64 45336cc (Terry Howe) * fix artifact directory a9659b0 (Terry Howe) * update configuration to v2 e368f17 (Terry Howe) * remove GOTOOLCHAIN e7bea85 (Terry Howe) * chore: replace mitchellh/gox with goreleaser 075c096 (Terry Howe) * chore(deps): bump github.com/distribution/distribution/v3 12f2c41 (dependabot[bot]) * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffd (dependabot[bot]) * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfb (dependabot[bot]) * Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df (Matheus Pimenta) * fix: adds topLevel permissions to improve openSSF scores 277d970 (Gagan H R) * Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7 * fix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24 (Matheus Pimenta) * docs: fix grammar and spacing in CONTRIBUTING.md db40adb (Mohit) * chore(deps): bump the k8s-io group with 7 updates 775e794 (dependabot[bot]) * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace3 (dependabot[bot]) * fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb (Matheus Pimenta) * chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7d (dependabot[bot]) * Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai) * test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971 (Johannes Lohmer) * fix(values): do not copy chart-default nils into coalesced values 0063877 (Johannes Lohmer) * test(values): add test for subchart nil producing %!s() 6eb4ebf (Johannes Lohmer) * test(values): add tests for subchart nil value regressions 5cb4e7d (Johannes Lohmer) * chore(deps): bump actions/upload-artifact fro

Fix available

Published

2026-10-19T09:48:48Z

Updated

2026-10-27T17:23:10.855975840Z

Stack: system

Check your server →