SUSE-SU-2026:24475-1

    Dashboard / Vulnerabilities / SUSE-SU-2026:24475-1

    SUSE-SU-2026:24475-1

    Published: 29 Oct 2026Last Modified: 4 Nov 2026

    Summary: Security update for google-guest-agent

    Details: This update for google-guest-agent fixes the following issues: - CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286994). - CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287058). - CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287137). - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285283). - CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287487). Update to version 20261022.00: - Update go dependencies (#641) - Remove stale Go module version overrides in _service file - Ship gce-workload-cert-refresh.timer (bsc#1273192) - Wait for new account to become visible before adding to groups (#635) - Update golang.org/x/crypto to v0.58.0 - Update golang.org/x/net to v0.61.0 - Validate username using unicode.IsSpace to reject all Unicode whitespace characters (#637) - Update dependencies to latest (#636) - fix octal digit comparison in morePermissive (#631) - Remove KillMode from google-guest-agent-manager (#629) - Fix SUSE Linux Micro 6+ (#628) (bsc#1253357) - Exclude irrelevant tests on FreeBSD (#625) - Replace abandoned serial dependency (#624) - Add build rules for MWLID extension

    References: https://www.suse.com/support/update/announcement/2026/suse-su-202624475-1/, https://bugzilla.suse.com/1253357, https://bugzilla.suse.com/1273192, https://bugzilla.suse.com/1285283, https://bugzilla.suse.com/1286994, https://bugzilla.suse.com/1287058, https://bugzilla.suse.com/1287137, https://bugzilla.suse.com/1287487, https://www.suse.com/security/cve/CVE-2026-78659, https://www.suse.com/security/cve/CVE-2026-78660, https://www.suse.com/security/cve/CVE-2026-78663, https://www.suse.com/security/cve/CVE-2026-78669, https://www.suse.com/security/cve/CVE-2026-97032

    Affected packages

    Package

    Name: google-guest-agent

    Purl: pkg:rpm/suse/google-guest-agent&distro=SUSE%20Linux%20Micro%206.0

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -20261022.00-159998.1.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2026:24475-1 | CVE-DB