Linux · 
openSUSE Leap · Security advisory · September 4, 2026
openSUSE Leap · Security advisory · September 4, 2026OPENSUSE-SU-2026:21761-1: govulncheck-vulndb security update
OPENSUSE-SU-2026:21761-1, released September 4, 2026, fixes 181 CVEs in govulncheck-vulndb (version 0.0.20260827T195228-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
181
4 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0859
95th percentile
Priority of the 181 CVEs
Patch now 0
Urgent 4
High 23
Routine 154
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| govulncheck-vulndb | opensuse-leap 16.0 | 0.0.20260827T195228-160000.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | 0.0183 | None reported |
| Urgent | CVE-2026-34178 | incus: In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the s... | 9.1 | 0.0043 | None reported |
| Urgent | CVE-2026-34177 | incus: Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/li... | 9.1 | 0.0037 | None reported |
| Urgent | CVE-2026-34179 | incus: In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate... | 9.1 | 0.0028 | None reported |
| High | CVE-2026-42508 | Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts | 9.1 | 0.0691 | None reported |
| High | CVE-2026-39832 | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent | 9.1 | 0.0068 | None reported |
| High | CVE-2026-33818 | Enforce maximum recursion depth in encoding/asn1 | 8.8 | 0.0057 | None reported |
| High | CVE-2026-56853 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http | 8.8 | 0.0057 | None reported |
| High | CVE-2026-56859 | Add recursion depth guard during decode in encoding/xml | 8.8 | 0.0057 | None reported |
| High | CVE-2026-56862 | Limit handshake messages we are willing to accept post-handshake in crypto/tls | 8.8 | 0.0057 | None reported |
| High | CVE-2026-59733 | govulncheck-vulndb: This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260827T195228 2026-08-27T19... | n/a | 0.0055 | None reported |
| High | CVE-2026-56860 | Avoid quadratic complexity in resolvePath in net/url | 8.8 | 0.0055 | None reported |
| High | CVE-2026-46600 | Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage | 7.5 | 0.0055 | None reported |
| High | CVE-2026-55677 | osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood | 8.2 | 0.0052 | None reported |
| High | CVE-2026-56852 | Infinite loop on invalid input in golang.org/x/text | 8.8 | 0.0048 | None reported |
| High | CVE-2026-35172 | docker-registry: Distribution is a toolkit to pack, ship, store, and deliver container content | 7.5 | 0.0047 | None reported |
| High | CVE-2026-39833 | Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent | 9.1 | 0.0047 | None reported |
| High | CVE-2026-17106 | Tar extraction in moby/go-archive can write outside the destination directory via link following | 8.8 | 0.0044 | None reported |
| High | CVE-2026-46603 | golang-golang-x-image: VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L im... | 7.5 | 0.0041 | None reported |
| High | CVE-2026-54572 | govulncheck-vulndb: This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260827T195228 2026-08-27T19... | n/a | 0.0040 | None reported |
| High | CVE-2026-73500 | etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline | n/a | 0.0040 | None reported |
| High | CVE-2026-71556 | go-git: Worktree operations may follow symlinks | 7.1 | 0.0036 | None reported |
| High | CVE-2026-56858 | Fix Javascript regexp context tracking in html/template | 8.8 | 0.0031 | None reported |
| High | CVE-2026-56864 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb | 7.5 | 0.0030 | None reported |
| High | CVE-2026-71313 | govulncheck-vulndb: This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260827T195228 2026-08-27T19... | n/a | 0.0030 | None reported |
Showing 1 to 25 of 181
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.