Linux · openSUSE Leap · Security advisory · June 17, 2026

OPENSUSE-SU-2026:21079-1: amazon-ssm-agent security update

OPENSUSE-SU-2026:21079-1, released June 17, 2026, fixes 21 CVEs in amazon-ssm-agent (version 3.3.4624.0-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
21
2 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0691
94th percentile

Priority of the 21 CVEs

Patch now 0 Urgent 2 High 14 Routine 5

Fixed package versions

ProductReleaseFixed in
amazon-ssm-agentopensuse-leap 16.03.3.4624.0-160000.1.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna10.0 0.0183 None reported
Urgent CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 0.0056 None reported
High CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 0.0691 None reported
High CVE-2025-22869 toolbox: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Se...7.5 0.0094 None reported
High CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 0.0068 None reported
High CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 0.0068 None reported
High CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent7.5 0.0067 None reported
High CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 0.0060 None reported
High CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh8.7 0.0050 None reported
High CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 0.0048 None reported
High CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 0.0047 None reported
High CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 0.0047 None reported
High CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh8.7 0.0047 None reported
High CVE-2026-44740 golang-github-go-git-go-billy-v6: Billy is an interface filesystem abstraction for Go7.5 0.0039 None reported
High CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh8.8 0.0037 None reported
High CVE-2026-41506 golang-github-go-git-go-git: go-git is an extensible git implementation library written in pure Go7.4 0.0026 None reported
Routine CVE-2026-1229 amazon-ssm-agent: This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang...n/a 0.0043 None reported
Routine CVE-2025-22870 golang-1.22: Matching of hosts against proxy patterns can improperly treat an IPv6 zoneID as a hostname component4.4 0.0043 None reported
Routine CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 0.0041 None reported
Routine CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 0.0028 None reported
Routine CVE-2026-25934 golang-github-go-git-go-git: go-git is a highly extensible git implementation library written in pure Go4.3 0.0016 None reported
Showing 1 to 21 of 21 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.