{
  "cveId": "CVE-2026-114437",
  "url": "https://patchblox.com/security/cve/CVE-2026-114437",
  "summary": "CVE-2026-114437 is fixed in hauler on 1 platform by OPENSUSE-SU-2026:22201-1 (version 2.1.2-bp160.1.1), released November 7, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "hauler: This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor:\n  * CVE-2026-114437: github....",
  "description": "This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor:\n  * CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in\n    \u0060ClientIPFromXFF\u0060 via \u0060X-Forwarded-For (bsc#1287881)\n\n- update to 2.1.2 (bsc#1285270, CVE-2026-78669):\n  * It fixes credential and presigned url leaks, local chart\n    handling, haul formats from \u0060--filename\u0060, and \u0060hauler store\n    copy\u0060 with image-type files and cosign bundles. It adds\n    \u0060hauler\u0060, \u0060hauler-dev\u0060, and \u0060hauler@\u0060 homebrew casks, and it\n    is the first release published through them. It also bumps go\n    to \u00601.27.2\u0060.",
  "published": "2026-10-28T15:26:29Z",
  "severity": "",
  "epss": 0.00129,
  "epssPercentile": 0.02603,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "hauler",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.1.2-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22201-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22201-1",
      "released": "2026-11-07T00:47:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}