SUSE-SU-2026:5119-1

Dashboard / Vulnerabilities / SUSE-SU-2026:5119-1

SUSE-SU-2026:5119-1

Summary: Security update for helm

Details: This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285273). - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468). - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). Changes for helm: - Update to version 3.22.1

References: https://www.suse.com/support/update/announcement/2026/suse-su-20265119-1/, https://bugzilla.suse.com/1281112, https://bugzilla.suse.com/1281468, https://bugzilla.suse.com/1281469, https://bugzilla.suse.com/1283642, https://bugzilla.suse.com/1285273, https://www.suse.com/security/cve/CVE-2026-63209, https://www.suse.com/security/cve/CVE-2026-78669, https://www.suse.com/security/cve/CVE-2026-81871, https://www.suse.com/security/cve/CVE-2026-81872, https://www.suse.com/security/cve/CVE-2026-85732