{
  "cveId": "CVE-2025-47908",
  "url": "https://patchblox.com/security/cve/CVE-2025-47908",
  "summary": "CVE-2025-47908 is fixed in golang-github-prometheus-alertmanager on 1 platform, first by SUSE-SU-2025:4481-1, released December 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "golang-github-prometheus-alertmanager: This update for golang-github-prometheus-alertmanager fixes the following issues:\n\n- Update to version 0.28.1 (jsc#PE...",
  "description": "This update for golang-github-prometheus-alertmanager fixes the following issues:\n\n- Update to version 0.28.1 (jsc#PED-13285):\n  * Improved performance of inhibition rules when using Equal\n    labels.\n  * Improve the documentation on escaping in UTF-8 matchers.\n  * Update alertmanager_config_hash metric help to document the\n    hash is not cryptographically strong.\n  * Fix panic in amtool when using --verbose.\n  * Fix templating of channel field for Rocket.Chat.\n  * Fix rocketchat_configs written as rocket_configs in docs.\n  * Fix usage for --enable-feature flag.\n  * Trim whitespace from OpsGenie API Key.\n  * Fix Jira project template not rendered when searching for\n    existing issues.\n  * Fix subtle bug in JSON/YAML encoding of inhibition rules that\n    would cause Equal labels to be omitted.\n  * Fix header for slack_configs in docs.\n  * Fix weight and wrap of Microsoft Teams notifications.\n- Upgrade to version 0.28.0:\n  * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).\n  * Templating errors in the SNS integration now return an error.\n  * Adopt log/slog, drop go-kit/log.\n  * Add a new Microsoft Teams integration based on Flows.\n  * Add a new Rocket.Chat integration.\n  * Add a new Jira integration.\n  * Add support for GOMEMLIMIT, enable it via the feature flag\n    --enable-feature=auto-gomemlimit.\n  * Add support for GOMAXPROCS, enable it via the feature flag\n    --enable-feature=auto-gomaxprocs.\n  * Add support for limits of silences including the maximum number\n    of active and pending silences, and the maximum size per\n    silence (in bytes). You can use the flags\n    --silences.max-silences and --silences.max-silence-size-bytes\n    to set them accordingly.\n  * Muted alerts now show whether they are suppressed or not in\n    both the /api/v2/alerts endpoint and the Alertmanager UI.\n- Upgrade to version 0.27.0:\n  * API: Removal of all api/v1/ endpoints. These endpoints\n    now log and return a deprecation message and respond with a\n    status code of 410.\n  * UTF-8 Support: Introduction of support for any UTF-8\n    character as part of label names and matchers.\n  * Discord Integration: Enforce max length in message.\n  * Metrics: Introduced the experimental feature flag\n    --enable-feature=receiver-name-in-metrics to include the\n    receiver name.\n  * Metrics: Introduced a new gauge named\n    alertmanager_inhibition_rules that counts the number of\n    configured inhibition rules.\n  * Metrics: Introduced a new counter named\n    alertmanager_alerts_supressed_total that tracks muted alerts,\n    it contains a reason label to indicate the source of the mute.\n  * Discord Integration: Introduced support for webhook_url_file.\n  * Microsoft Teams Integration: Introduced support for\n    webhook_url_file.\n  * Microsoft Teams Integration: Add support for summary.\n  * Metrics: Notification metrics now support two new values for\n    the label reason, contextCanceled and contextDeadlineExceeded.\n  * Email Integration: Contents of auth_password_file are now\n    trimmed of prefixed and suffixed whitespace.\n  * amtool: Fixes the error scheme required for webhook url when\n    using amtool with --alertmanager.url.\n  * Mixin: Fix AlertmanagerFailedToSendAlerts,\n    AlertmanagerClusterFailedToSendAlerts, and\n    AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n    the reason label.",
  "published": "2025-12-18T12:18:50Z",
  "severity": "",
  "epss": 0.00678,
  "epssPercentile": 0.52567,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "golang-github-prometheus-alertmanager",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.28.1-150100.4.28.2",
      "fix": "SUSE-SU-2025:4481-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4481-1",
      "released": "2025-12-18T12:18:50Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-alertmanager",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.28.1-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21136-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21136-1",
      "released": "2026-06-18T08:21:46Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-alertmanager",
      "release": "sles 15.6",
      "fixedVersion": "0.28.1-150100.4.28.2",
      "fix": "SUSE-SU-2025:4481-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4481-1",
      "released": "2025-12-18T12:18:50Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-alertmanager",
      "release": "sles 15.7",
      "fixedVersion": "0.28.1-150100.4.28.2",
      "fix": "SUSE-SU-2025:4481-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4481-1",
      "released": "2025-12-18T12:18:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}