OPENSUSE-SU-2026:21395-1
Advisory lineage Upstream: 3 Downstream: 0
Published: 20 Jul 2026, 15:04
Last modified:24 Jul 2026, 18:24
Vulnerability Summary
Overall Risk (default)
minimal
0/100 CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
20 Jul 2026, 15:04
Published
Vulnerability first disclosed
24 Jul 2026, 18:24
Last Modified
Vulnerability information updated
Description
Security update for trivy This update for trivy fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266495). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271658). - CVE-2026-56852: trivy: infinite loop on truncated/invalid UTF-8 input (bsc#1271670).
Affected Systems
- opensuse•trivy&distro=openSUSE Leap 16.0
< 0.72.0-160000.2.1