{
  "cveId": "CVE-2026-39827",
  "url": "https://patchblox.com/security/cve/CVE-2026-39827",
  "summary": "CVE-2026-39827 is fixed in 30 products on 1 platform, first by DEBIAN-CVE-2026-39827, released May 22, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Invoking  memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh",
  "description": "This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\t\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n  (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n  (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n   also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n   hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n   of document state files\n * Add read-only version check prior to install and uninstall\n   in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n   to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n   cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n   from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n   (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n   both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)",
  "published": "2026-05-22T04:16:21Z",
  "severity": "Moderate",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
  "epss": 0.00279,
  "epssPercentile": 0.20541,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-39827",
  "fixes": [
    {
      "platform": "linux",
      "product": "alloy",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.17.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21251-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21251-1",
      "released": "2026-07-07T17:00:29Z"
    },
    {
      "platform": "linux",
      "product": "alloy",
      "release": "sles 15.7",
      "fixedVersion": "1.17.1-150700.15.23.1",
      "fix": "SUSE-SU-2026:2824-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2824-1",
      "released": "2026-07-09T18:18:01Z"
    },
    {
      "platform": "linux",
      "product": "alloy",
      "release": "sles 16.0",
      "fixedVersion": "1.17.0-160000.1.1",
      "fix": "SUSE-SU-2026:22575-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22575-1",
      "released": "2026-07-07T16:59:00Z"
    },
    {
      "platform": "linux",
      "product": "amazon-cloudwatch-agent",
      "release": "amzn 2023",
      "fixedVersion": "1.300069.1-1.amzn2023",
      "fix": "ALAS2023-2026-2025",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2025",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "amazon-ssm-agent",
      "release": "amzn 2023",
      "fixedVersion": "3.3.4624.0-1.amzn2023",
      "fix": "ALAS2023-2026-1952",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1952",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "amazon-ssm-agent",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.3.4624.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21079-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21079-1",
      "released": "2026-06-17T16:32:56Z"
    },
    {
      "platform": "linux",
      "product": "amazon-ssm-agent",
      "release": "sles 15.6",
      "fixedVersion": "3.3.4624.0-150000.5.37.1",
      "fix": "SUSE-SU-2026:2467-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2467-1",
      "released": "2026-06-19T11:03:15Z"
    },
    {
      "platform": "linux",
      "product": "amazon-ssm-agent",
      "release": "sles 15.7",
      "fixedVersion": "3.3.4624.0-150000.5.37.1",
      "fix": "SUSE-SU-2026:2467-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2467-1",
      "released": "2026-06-19T11:03:15Z"
    },
    {
      "platform": "linux",
      "product": "amazon-ssm-agent",
      "release": "sles 16.0",
      "fixedVersion": "3.3.4624.0-160000.1.1",
      "fix": "SUSE-SU-2026:22157-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22157-1",
      "released": "2026-06-17T16:31:19Z"
    },
    {
      "platform": "linux",
      "product": "apptainer",
      "release": "sles 15.7",
      "fixedVersion": "1.5.1-150600.4.24.1",
      "fix": "SUSE-SU-2026:2609-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2609-1",
      "released": "2026-06-24T08:46:20Z"
    },
    {
      "platform": "linux",
      "product": "buildah",
      "release": "sles 15.6",
      "fixedVersion": "1.35.5-150500.3.62.1",
      "fix": "SUSE-SU-2026:2733-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2733-1",
      "released": "2026-07-02T18:05:08Z"
    },
    {
      "platform": "linux",
      "product": "buildah",
      "release": "sles 15.7",
      "fixedVersion": "1.35.5-150500.3.62.1",
      "fix": "SUSE-SU-2026:2733-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2733-1",
      "released": "2026-07-02T18:05:08Z"
    },
    {
      "platform": "linux",
      "product": "cloudflared",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2026.9.1-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21924-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21924-1",
      "released": "2026-09-21T14:05:15Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "amzn 2023",
      "fixedVersion": "2.2.4-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1784",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1784",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.2.4-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1784",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1784",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "2.2.4-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1784",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1784",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-stress",
      "release": "amzn 2023",
      "fixedVersion": "2.2.4-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1784",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1784",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-stress-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.2.4-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1784",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1784",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerized-data-importer",
      "release": "sles 15.7",
      "fixedVersion": "1.64.0-150700.9.14.1",
      "fix": "SUSE-SU-2026:4209-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4209-1",
      "released": "2026-09-16T11:50:36Z"
    },
    {
      "platform": "linux",
      "product": "containerized-data-importer1.65",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.65.0-160000.3.1",
      "fix": "OPENSUSE-SU-2026:21824-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21824-1",
      "released": "2026-09-09T15:12:11Z"
    },
    {
      "platform": "linux",
      "product": "cosign",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.1.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21281-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21281-1",
      "released": "2026-07-10T08:42:03Z"
    },
    {
      "platform": "linux",
      "product": "cosign",
      "release": "sles 15.6",
      "fixedVersion": "3.1.1-150400.3.45.1",
      "fix": "SUSE-SU-2026:2827-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2827-1",
      "released": "2026-07-09T18:28:27Z"
    },
    {
      "platform": "linux",
      "product": "cosign",
      "release": "sles 15.7",
      "fixedVersion": "3.1.1-150400.3.45.1",
      "fix": "SUSE-SU-2026:2827-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2827-1",
      "released": "2026-07-09T18:28:27Z"
    },
    {
      "platform": "linux",
      "product": "cosign",
      "release": "sles 16.0",
      "fixedVersion": "3.1.1-160000.1.1",
      "fix": "SUSE-SU-2026:22613-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22613-1",
      "released": "2026-07-10T08:43:40Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.1.1-160000.3.1",
      "fix": "OPENSUSE-SU-2026:21898-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21898-1",
      "released": "2026-09-21T12:26:04Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 15.6",
      "fixedVersion": "3.1.1-150400.9.41.1",
      "fix": "SUSE-SU-2026:4212-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4212-1",
      "released": "2026-09-16T11:52:48Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 15.7",
      "fixedVersion": "3.1.1-150400.9.41.1",
      "fix": "SUSE-SU-2026:4212-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4212-1",
      "released": "2026-09-16T11:52:48Z"
    },
    {
      "platform": "linux",
      "product": "distribution",
      "release": "sles 16.0",
      "fixedVersion": "3.1.1-160000.3.1",
      "fix": "SUSE-SU-2026:23864-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23864-1",
      "released": "2026-09-21T12:23:04Z"
    },
    {
      "platform": "linux",
      "product": "glab",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.114.0-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21662-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21662-1",
      "released": "2026-08-26T16:07:54Z"
    },
    {
      "platform": "linux",
      "product": "golang-go.crypto",
      "release": "Debian 14",
      "fixedVersion": "1:0.52.0-1",
      "fix": "DEBIAN-CVE-2026-39827",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-39827",
      "released": "2026-05-22T04:16:21Z"
    },
    {
      "platform": "linux",
      "product": "google-guest-agent",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "20260529.00-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21069-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21069-1",
      "released": "2026-06-26T08:17:18Z"
    },
    {
      "platform": "linux",
      "product": "google-guest-agent",
      "release": "sles 15.6",
      "fixedVersion": "20260529.00-150000.1.70.1",
      "fix": "SUSE-SU-2026:2612-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2612-1",
      "released": "2026-06-24T09:01:18Z"
    },
    {
      "platform": "linux",
      "product": "google-guest-agent",
      "release": "sles 15.7",
      "fixedVersion": "20260529.00-150000.1.70.1",
      "fix": "SUSE-SU-2026:2612-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2612-1",
      "released": "2026-06-24T09:01:18Z"
    },
    {
      "platform": "linux",
      "product": "google-guest-agent",
      "release": "sles 16.0",
      "fixedVersion": "20260529.00-160000.1.1",
      "fix": "SUSE-SU-2026:22376-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22376-1",
      "released": "2026-06-26T08:29:53Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "20260615.01-160000.1.2",
      "fix": "OPENSUSE-SU-2026:21210-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21210-1",
      "released": "2026-07-06T20:10:17Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "sles 15.6",
      "fixedVersion": "20260615.01-150000.1.55.1",
      "fix": "SUSE-SU-2026:2611-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2611-1",
      "released": "2026-06-24T09:00:24Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "sles 15.7",
      "fixedVersion": "20260615.01-150000.1.55.1",
      "fix": "SUSE-SU-2026:2611-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2611-1",
      "released": "2026-06-24T09:00:24Z"
    },
    {
      "platform": "linux",
      "product": "google-osconfig-agent",
      "release": "sles 16.0",
      "fixedVersion": "20260615.01-160000.1.2",
      "fix": "SUSE-SU-2026:22558-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22558-1",
      "released": "2026-07-06T20:10:31Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    },
    {
      "platform": "linux",
      "product": "kubevirt",
      "release": "sles 15.7",
      "fixedVersion": "1.7.4-150700.3.30.1",
      "fix": "SUSE-SU-2026:3203-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3203-1",
      "released": "2026-07-23T13:33:49Z"
    },
    {
      "platform": "linux",
      "product": "kubevirt1.8",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.8.4-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21590-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21590-1",
      "released": "2026-08-18T16:05:12Z"
    },
    {
      "platform": "linux",
      "product": "mcphost",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.34.0-160000.2.1",
      "fix": "OPENSUSE-SU-2026:21120-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21120-1",
      "released": "2026-06-20T06:52:26Z"
    },
    {
      "platform": "linux",
      "product": "mcphost",
      "release": "sles 16.0",
      "fixedVersion": "0.34.0-160000.2.1",
      "fix": "SUSE-SU-2026:22193-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22193-1",
      "released": "2026-06-20T06:52:25Z"
    },
    {
      "platform": "linux",
      "product": "nerdctl",
      "release": "amzn 2023",
      "fixedVersion": "2.2.2-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-1788",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1788",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "podman",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.4.2-160000.5.1",
      "fix": "OPENSUSE-SU-2026:21244-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21244-1",
      "released": "2026-07-06T15:38:19Z"
    },
    {
      "platform": "linux",
      "product": "rclone",
      "release": "amzn 2023",
      "fixedVersion": "1.74.2-80.amzn2023",
      "fix": "ALAS2023-2026-1810",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1810",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rclone",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.74.4-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21436-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21436-1",
      "released": "2026-07-22T20:54:49Z"
    },
    {
      "platform": "linux",
      "product": "rclone-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.74.2-80.amzn2023",
      "fix": "ALAS2023-2026-1810",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1810",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rclone-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.74.2-80.amzn2023",
      "fix": "ALAS2023-2026-1810",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1810",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "runfinch-finch",
      "release": "amzn 2023",
      "fixedVersion": "1.17.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2026-1809",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1809",
      "released": "2026-06-08T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "trivy",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.71.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20956-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20956-1",
      "released": "2026-06-11T15:29:49Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}