# OPENSUSE-SU-2026:21551-1: govulncheck-vulndb security update OPENSUSE-SU-2026:21551-1, released August 10, 2026, fixes 77 CVEs in govulncheck-vulndb (version 0.0.20260727T201416-160000.1.1). None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-21551-1 - Platform: Linux - Released: Aug 10, 2026 - Priority: High (Closes CVE-2026-29181, high severity) - CVEs: 77, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:21551-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [govulncheck-vulndb](https://patchblox.com/security/data/product/linux/govulncheck-vulndb.md) | opensuse-leap 16.0 | 0.0.20260727T201416-160000.1.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-29181](https://patchblox.com/security/data/cve/CVE-2026-29181.md) | High | OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) | 7.5 | 0.0082 | | | [CVE-2026-45135](https://patchblox.com/security/data/cve/CVE-2026-45135.md) | High | caddy: Caddy is an extensible server platform that uses TLS by default | 8.1 | 0.0068 | | | [CVE-2026-52844](https://patchblox.com/security/data/cve/CVE-2026-52844.md) | High | caddy: Caddy is an extensible server platform that uses TLS by default | 7.5 | 0.0062 | | | [CVE-2026-41643](https://patchblox.com/security/data/cve/CVE-2026-41643.md) | High | govulncheck-vulndb: GO-2026-5266 GHSA-8rxh-r2p6-7f2q | 7.5 | 0.0054 | | | [CVE-2026-41642](https://patchblox.com/security/data/cve/CVE-2026-41642.md) | High | govulncheck-vulndb: GO-2026-5198 GHSA-7235-89m6-f4px | 7.5 | 0.0050 | | | [CVE-2026-52845](https://patchblox.com/security/data/cve/CVE-2026-52845.md) | High | caddy: Caddy is an extensible server platform that uses TLS by default | 8.1 | 0.0045 | | | [CVE-2026-40611](https://patchblox.com/security/data/cve/CVE-2026-40611.md) | High | govulncheck-vulndb: GO-2026-5593 GHSA-qqx8-2xmm-jrv8 | 8.8 | 0.0042 | | | [CVE-2026-42285](https://patchblox.com/security/data/cve/CVE-2026-42285.md) | High | govulncheck-vulndb: GO-2026-5525 GHSA-p3w2-64xm-833j | 7.5 | 0.0042 | | | [CVE-2026-50163](https://patchblox.com/security/data/cve/CVE-2026-50163.md) | High | golang-oras-oras-go: oras-go is a Go library for managing OCI artifacts | 7.1 | 0.0040 | | | [CVE-2026-44740](https://patchblox.com/security/data/cve/CVE-2026-44740.md) | High | golang-github-go-git-go-billy-v6: Billy is an interface filesystem abstraction for Go | 7.5 | 0.0039 | | | [CVE-2026-50151](https://patchblox.com/security/data/cve/CVE-2026-50151.md) | High | golang-oras-oras-go: oras-go is a Go library for managing OCI artifacts | 7.5 | 0.0038 | | | [CVE-2026-40890](https://patchblox.com/security/data/cve/CVE-2026-40890.md) | High | github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer | 7.5 | 0.0035 | | | [CVE-2026-41178](https://patchblox.com/security/data/cve/CVE-2026-41178.md) | High | alloy: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS | 8.2 | 0.0034 | | | [CVE-2026-44973](https://patchblox.com/security/data/cve/CVE-2026-44973.md) | High | golang-github-go-git-go-billy-v6: Billy is an interface filesystem abstraction for Go | 8.1 | 0.0031 | | | [CVE-2026-37462](https://patchblox.com/security/data/cve/CVE-2026-37462.md) | High | govulncheck-vulndb: GO-2026-5971 GHSA-pw7p-7fqv-hpj8 | 7.5 | 0.0028 | | | [CVE-2026-44301](https://patchblox.com/security/data/cve/CVE-2026-44301.md) | High | govulncheck-vulndb: GO-2026-5740 GHSA-x597-9fr4-5857 | 8.1 | 0.0027 | | | [CVE-2026-41506](https://patchblox.com/security/data/cve/CVE-2026-41506.md) | High | amazon-ssm-agent: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during | 7.4 | 0.0026 | | | [CVE-2026-45022](https://patchblox.com/security/data/cve/CVE-2026-45022.md) | High | govulncheck-vulndb: GO-2026-5074 GHSA-389r-gv7p-r3rp | 7.5 | 0.0016 | | | [CVE-2026-42306](https://patchblox.com/security/data/cve/CVE-2026-42306.md) | High | docker.io: Moby is an open source container framework | 7.2 | 0.0010 | | | [CVE-2026-7482](https://patchblox.com/security/data/cve/CVE-2026-7482.md) | Routine | govulncheck-vulndb: GO-2026-5748 GHSA-x8qc-fggm-mpqg | n/a | 0.0224 | | | [CVE-2026-32952](https://patchblox.com/security/data/cve/CVE-2026-32952.md) | Routine | govulncheck-vulndb: GO-2026-5543 GHSA-pjcq-xvwq-hhpj | n/a | 0.0103 | | | [CVE-2026-7020](https://patchblox.com/security/data/cve/CVE-2026-7020.md) | Routine | govulncheck-vulndb: GO-2026-5750 GHSA-x99g-8v8j-25j2 | n/a | 0.0091 | | | [CVE-2026-50274](https://patchblox.com/security/data/cve/CVE-2026-50274.md) | Routine | govulncheck-vulndb: GO-2026-6000 GHSA-74j5-xf3v-crq8 | n/a | 0.0079 | | | [CVE-2026-25038](https://patchblox.com/security/data/cve/CVE-2026-25038.md) | Routine | govulncheck-vulndb: GO-2026-6076 GHSA-v73x-hx65-6pf4 | n/a | 0.0062 | | | [CVE-2026-46385](https://patchblox.com/security/data/cve/CVE-2026-46385.md) | Routine | govulncheck-vulndb: GO-2026-5046 GHSA-w8j3-pq8g-8m7w | n/a | 0.0061 | | | [CVE-2026-54063](https://patchblox.com/security/data/cve/CVE-2026-54063.md) | Routine | govulncheck-vulndb: GO-2026-5960 GHSA-h69g-9hx6-f3v4 | n/a | 0.0061 | | | [CVE-2026-58443](https://patchblox.com/security/data/cve/CVE-2026-58443.md) | Routine | govulncheck-vulndb: GO-2026-6086 GHSA-xxjv-752h-3vp2 | n/a | 0.0058 | | | [CVE-2026-46384](https://patchblox.com/security/data/cve/CVE-2026-46384.md) | Routine | govulncheck-vulndb: GO-2026-5047 GHSA-mc57-h6j3-3hmv | n/a | 0.0055 | | | [CVE-2026-42931](https://patchblox.com/security/data/cve/CVE-2026-42931.md) | Routine | govulncheck-vulndb: GO-2026-6082 GHSA-wwqq-x6w4-frm2 | n/a | 0.0053 | | | [CVE-2026-58439](https://patchblox.com/security/data/cve/CVE-2026-58439.md) | Routine | govulncheck-vulndb: GO-2026-6080 GHSA-w5pg-649r-p6gg | n/a | 0.0053 | | | [CVE-2026-34783](https://patchblox.com/security/data/cve/CVE-2026-34783.md) | Routine | govulncheck-vulndb: GO-2026-5452 GHSA-j6v5-g24h-vg4j | n/a | 0.0052 | | | [CVE-2026-44332](https://patchblox.com/security/data/cve/CVE-2026-44332.md) | Routine | govulncheck-vulndb: GO-2026-5886 GHSA-g5vh-55hw-rxm8 | n/a | 0.0052 | | | [CVE-2026-55982](https://patchblox.com/security/data/cve/CVE-2026-55982.md) | Routine | govulncheck-vulndb: GO-2026-6065 GHSA-mg4f-x9v4-6h2p | n/a | 0.0051 | | | [CVE-2026-56750](https://patchblox.com/security/data/cve/CVE-2026-56750.md) | Routine | govulncheck-vulndb: GO-2026-6072 GHSA-rgv6-xp99-6mgj | n/a | 0.0048 | | | [CVE-2026-58417](https://patchblox.com/security/data/cve/CVE-2026-58417.md) | Routine | govulncheck-vulndb: GO-2026-6063 GHSA-jr5x-6h83-wrxf | n/a | 0.0047 | | | [CVE-2026-58427](https://patchblox.com/security/data/cve/CVE-2026-58427.md) | Routine | govulncheck-vulndb: GO-2026-6068 GHSA-prr9-9mp4-5gp2 | n/a | 0.0047 | | | [CVE-2026-58434](https://patchblox.com/security/data/cve/CVE-2026-58434.md) | Routine | govulncheck-vulndb: GO-2026-6062 GHSA-j2w3-9c3r-g83q | n/a | 0.0047 | | | [CVE-2026-58438](https://patchblox.com/security/data/cve/CVE-2026-58438.md) | Routine | govulncheck-vulndb: GO-2026-6085 GHSA-xv9x-fj9g-vj6h | n/a | 0.0047 | | | [CVE-2026-45045](https://patchblox.com/security/data/cve/CVE-2026-45045.md) | Routine | govulncheck-vulndb: GO-2026-5887 GHSA-gcfq-8gqf-4876 | n/a | 0.0046 | | | [CVE-2026-55984](https://patchblox.com/security/data/cve/CVE-2026-55984.md) | Routine | govulncheck-vulndb: GO-2026-6064 GHSA-m932-crvm-gcp5 | n/a | 0.0046 | | | [CVE-2026-24451](https://patchblox.com/security/data/cve/CVE-2026-24451.md) | Routine | govulncheck-vulndb: GO-2026-6081 GHSA-wrf9-r3h7-7x5v | n/a | 0.0045 | | | [CVE-2026-54448](https://patchblox.com/security/data/cve/CVE-2026-54448.md) | Routine | govulncheck-vulndb: GO-2026-5983 GHSA-q3fv-x8vg-qqm4 | n/a | 0.0044 | | | [CVE-2026-50162](https://patchblox.com/security/data/cve/CVE-2026-50162.md) | Routine | golang-oras-oras-go: oras-go is a Go library for managing OCI artifacts | n/a | 0.0044 | | | [CVE-2026-58432](https://patchblox.com/security/data/cve/CVE-2026-58432.md) | Routine | govulncheck-vulndb: GO-2026-6070 GHSA-q9pg-jj6x-j9p6 | n/a | 0.0043 | | | [CVE-2026-58442](https://patchblox.com/security/data/cve/CVE-2026-58442.md) | Routine | govulncheck-vulndb: GO-2026-6058 GHSA-h2x6-g7q6-344v | n/a | 0.0043 | | | [CVE-2026-55987](https://patchblox.com/security/data/cve/CVE-2026-55987.md) | Routine | govulncheck-vulndb: GO-2026-6078 GHSA-vrhc-jjfc-m3m3 | n/a | 0.0041 | | | [CVE-2026-49838](https://patchblox.com/security/data/cve/CVE-2026-49838.md) | Routine | govulncheck-vulndb: GO-2026-5954 GHSA-frrj-87jh-2772 | 5.9 | 0.0041 | | | [CVE-2026-58421](https://patchblox.com/security/data/cve/CVE-2026-58421.md) | Routine | govulncheck-vulndb: GO-2026-6077 GHSA-v96j-25gv-g2w9 | n/a | 0.0040 | | | [CVE-2026-8276](https://patchblox.com/security/data/cve/CVE-2026-8276.md) | Routine | bettercap: A flaw has been found in bettercap up to 2.41.5 | n/a | 0.0039 | | | [CVE-2026-58507](https://patchblox.com/security/data/cve/CVE-2026-58507.md) | Routine | govulncheck-vulndb: GO-2026-6066 GHSA-p4mj-98mv-xq26 | n/a | 0.0038 | | | [CVE-2026-58445](https://patchblox.com/security/data/cve/CVE-2026-58445.md) | Routine | govulncheck-vulndb: GO-2026-6067 GHSA-pgqf-926r-548m | n/a | 0.0037 | | | [CVE-2026-49837](https://patchblox.com/security/data/cve/CVE-2026-49837.md) | Routine | govulncheck-vulndb: GO-2026-5955 GHSA-gjrg-jjr3-56cm | 5.9 | 0.0033 | | | [CVE-2026-58425](https://patchblox.com/security/data/cve/CVE-2026-58425.md) | Routine | govulncheck-vulndb: GO-2026-6079 GHSA-vxv2-8j6r-pcpg | n/a | 0.0033 | | | [CVE-2026-58431](https://patchblox.com/security/data/cve/CVE-2026-58431.md) | Routine | govulncheck-vulndb: GO-2026-6059 GHSA-h56g-4qw7-2mxg | n/a | 0.0033 | | | [CVE-2026-58510](https://patchblox.com/security/data/cve/CVE-2026-58510.md) | Routine | govulncheck-vulndb: GO-2026-6069 GHSA-q423-49rw-g9mh | n/a | 0.0033 | | | [CVE-2026-6993](https://patchblox.com/security/data/cve/CVE-2026-6993.md) | Routine | govulncheck-vulndb: GO-2026-5471 GHSA-jj45-xvq5-rhh9 | n/a | 0.0032 | | | [CVE-2026-2303](https://patchblox.com/security/data/cve/CVE-2026-2303.md) | Routine | alloy: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling | n/a | 0.0031 | | | [CVE-2026-58418](https://patchblox.com/security/data/cve/CVE-2026-58418.md) | Routine | govulncheck-vulndb: GO-2026-6075 GHSA-rqhx-647v-wx32 | n/a | 0.0031 | | | [CVE-2026-45571](https://patchblox.com/security/data/cve/CVE-2026-45571.md) | Routine | go-git: Crafted repositories may modify main and submodule .git directories | 5.4 | 0.0030 | | | [CVE-2026-58435](https://patchblox.com/security/data/cve/CVE-2026-58435.md) | Routine | govulncheck-vulndb: GO-2026-6073 GHSA-rh79-75qm-gwjr | n/a | 0.0029 | | | [CVE-2026-23603](https://patchblox.com/security/data/cve/CVE-2026-23603.md) | Routine | govulncheck-vulndb: GO-2026-6083 GHSA-x77v-q46j-393g | n/a | 0.0029 | | | [CVE-2026-59766](https://patchblox.com/security/data/cve/CVE-2026-59766.md) | Routine | govulncheck-vulndb: GO-2026-6071 GHSA-qf2f-qh6p-7v89 | n/a | 0.0028 | | | [CVE-2026-39883](https://patchblox.com/security/data/cve/CVE-2026-39883.md) | Routine | govulncheck-vulndb: GO-2026-5426 GHSA-hfvc-g4fc-pqhx | n/a | 0.0026 | | | [CVE-2026-30246](https://patchblox.com/security/data/cve/CVE-2026-30246.md) | Routine | govulncheck-vulndb: GO-2026-5069 GHSA-35hp-hqmv-8qg8 | n/a | 0.0025 | | | [CVE-2026-52846](https://patchblox.com/security/data/cve/CVE-2026-52846.md) | Routine | caddy: Caddy is an extensible server platform that uses TLS by default | 4.2 | 0.0025 | | | [CVE-2026-44166](https://patchblox.com/security/data/cve/CVE-2026-44166.md) | Routine | govulncheck-vulndb: GO-2026-5548 GHSA-pq7p-mc74-g65w | n/a | 0.0025 | | | [CVE-2026-58426](https://patchblox.com/security/data/cve/CVE-2026-58426.md) | Routine | govulncheck-vulndb: GO-2026-6060 GHSA-hg5r-vq93-9fv6 | n/a | 0.0023 | | | [CVE-2026-44283](https://patchblox.com/security/data/cve/CVE-2026-44283.md) | Routine | etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks | 6.5 | 0.0023 | | | [CVE-2026-35205](https://patchblox.com/security/data/cve/CVE-2026-35205.md) | Routine | govulncheck-vulndb: GO-2026-5566 GHSA-q5jf-9vfq-h4h7 | n/a | 0.0022 | | | [CVE-2026-42554](https://patchblox.com/security/data/cve/CVE-2026-42554.md) | Routine | govulncheck-vulndb: GO-2026-5585 GHSA-qjv7-627w-8qjv | n/a | 0.0021 | | | [CVE-2026-53624](https://patchblox.com/security/data/cve/CVE-2026-53624.md) | Routine | govulncheck-vulndb: GO-2026-5912 GHSA-gv83-gqw6-9j2c | n/a | 0.0021 | | | [CVE-2026-48978](https://patchblox.com/security/data/cve/CVE-2026-48978.md) | Routine | golang-oras-oras-go: oras-go is a Go library for managing OCI artifacts | n/a | 0.0021 | | | [CVE-2026-35206](https://patchblox.com/security/data/cve/CVE-2026-35206.md) | Routine | Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment | n/a | 0.0021 | | | [CVE-2026-35204](https://patchblox.com/security/data/cve/CVE-2026-35204.md) | Routine | govulncheck-vulndb: GO-2026-5666 GHSA-vmx8-mqv2-9gmg | n/a | 0.0021 | | | [CVE-2026-44517](https://patchblox.com/security/data/cve/CVE-2026-44517.md) | Routine | govulncheck-vulndb: GO-2026-5116 GHSA-49p4-px3h-rq49 | 6.3 | 0.0018 | | | [CVE-2026-58441](https://patchblox.com/security/data/cve/CVE-2026-58441.md) | Routine | govulncheck-vulndb: GO-2026-6084 GHSA-xmj7-xj85-hfc3 | n/a | 0.0017 | | | [CVE-2026-42328](https://patchblox.com/security/data/cve/CVE-2026-42328.md) | Routine | govulncheck-vulndb: GO-2026-5684 GHSA-w239-58x2-q8p5 | n/a | 0.0012 | | --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.