{
  "cveId": "CVE-2026-45682",
  "url": "https://patchblox.com/security/cve/CVE-2026-45682",
  "summary": "CVE-2026-45682 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:22575-1, released July 7, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "alloy: This update for alloy fixes the following issues\n\n- CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundar...",
  "description": "This update for alloy fixes the following issues\n\n- CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing malformed ELF/BTF input (bsc#1267811).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267185).\n- CVE-2026-33532: Denial of Service via deeply nested YAML document parsing (bsc#1260981).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues (bsc#1266196).\n- CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: SQL injection when placeholders in dollar-quoted string literals are used in the SQL query (bsc#1265440).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).\n- CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).\n- CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by \u0060CappedConcurrentHashMap\u0060 after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).\n- CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on malformed wire messages and causes a DoS (bsc#1267488).\n- CVE-2026-45686: go.opentelemetry.io/obi: integer overflow in memcached text protocol parser can crash the OBI process and cause denial of service (bsc#1267489).",
  "published": "2026-07-07T16:59:00Z",
  "severity": "",
  "epss": 0.00162,
  "epssPercentile": 0.05357,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "alloy",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.17.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21251-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21251-1",
      "released": "2026-07-07T17:00:29Z"
    },
    {
      "platform": "linux",
      "product": "alloy",
      "release": "sles 15.7",
      "fixedVersion": "1.17.1-150700.15.23.1",
      "fix": "SUSE-SU-2026:2824-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2824-1",
      "released": "2026-07-09T18:18:01Z"
    },
    {
      "platform": "linux",
      "product": "alloy",
      "release": "sles 16.0",
      "fixedVersion": "1.17.0-160000.1.1",
      "fix": "SUSE-SU-2026:22575-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22575-1",
      "released": "2026-07-07T16:59:00Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}