# CVE-2026-45683: alloy: This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has... CVE-2026-45683 is fixed in 2 products on 1 platform, first by OPENSUSE-SU-2026:21483-1, released July 30, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-45683 - Priority: Routine - CVSS: n/a - EPSS: 0.0017 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 30, 2026 ## Description This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861). - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742). - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482). - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483). - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484). - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486). - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487). - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer (bsc#1272418). - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (bsc#1268982). - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272028). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278671). - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276982). - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276992). - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing users who can modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through `bearerTokenFile` (bsc#1277429). - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated database name in Client.BulkWrite (bsc#1278693). - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response frames containing a crafted header value type byte outside the valid range can cause the host process to terminate (bsc#1280671). Changes for alloy: - Update to version 1.19.2. - Update to version 1.19.1. - Update to version 1.19.0: * BREAKING CHANGE: prometheus.operator.servicemonitors now rejects endpoints that reference local files by default. Set allow_arbitrary_file_access = true to preserve previous behavior. * prometheus.enrich: Support multi-label matching * prometheus.relabel: Add opt-in TTL cache mode * telemetry: Add new metrics for graph connections and pyroscope forwarded entries * database_observability: Exclude system schemas from MySQL health checks and redact query text in explain_plans - Update to version 1.18.1: * Add nop receiver to OTel Engine ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | alloy opensuse-leap 16.0 | 1.19.2-160000.1.1 | [OPENSUSE-SU-2026:22032-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22032-1.md) | Oct 6, 2026 | | Linux | alloy sles 15.7 | 1.19.2-150700.15.29.1 | [SUSE-SU-2026:4408-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4408-1.md) | Oct 1, 2026 | | Linux | alloy sles 16.0 | 1.19.2-160000.1.1 | [SUSE-SU-2026:24148-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24148-1.md) | Oct 6, 2026 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.