SUSE-SU-2026:2438-1

Advisory lineage Upstream: 6 Downstream: 0
Published: 17 Jun 2026, 14:45
Last modified:18 Jun 2026, 08:15

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Jun 2026, 14:45
Published
Vulnerability first disclosed
18 Jun 2026, 08:15
Last Modified
Vulnerability information updated

Description

Security update for alloy This update for alloy fixes the following issues Security issues: - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919). - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099). - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609). - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317). - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955). - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530). Non security issue: - Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815). - Update to version 1.16.1 * Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby - Use latest openSUSE Tumbleweed image for building web UI assets - Install nvm to set node version specified upstream - update to 1.16.0: * Features - Add clustering for loki.source.kubernetes_events (#6027) (3dbf587) (@petewall) - Add otelcol.auth.google client auth provider (#5526) (da99a66) (@dashpole, @clayton-cornell) - beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc) - database_observability: Add support for GCP Cloud SQL metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell) - database_observability: Make targets optional (#5924) (54664b2) (@matthewnolf) - database_observability: Update default excluded schemas and users (#6080) (b386fff) (@cristiangreco) - faro.receiver: Add sourcemap fetching from remote locations (#4614) (b6cb5da) (@Oxel40) - helm: Add support for global.image.pullPolicy (#6069) (2e2ce72) (@petewall) - helm: Allow configuring image pull policy for config reloader (#5923) (991539b) (@kalleep) - loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#5898) (2ad8834) (@kleimkuhler) - loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#5855) (053a2f7) (@kleimkuhler) - loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#5909) (c16a660) (@mikefat) - loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#5970) (b16decb) (@kleimkuhler) - Oracle exporter can scrape more than one DB (#6008) (6fbad38) (@ptodev) - prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix) - prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#5836) (4f49b57) (@cristiangreco) - prometheus.remote_write: Sync WAL with upstream Prometheus (#5907) (e74a91b) (@x1unix) - pyroscope: Add support for extra async-profiler CLI arguments (#5472) (9251e33) (@ivanape) - pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API (#5891) (e7ea34a) (@korniltsev-grafanista) - pyroscope: Update debuginfo client for HTTP/1.1 upload API (#6037) (879d8e5) (@korniltsev-grafanista) - Change service stop command from 'sc' to 'net' (#5906) (450973d) (@mateuszdrab) - database_observability.mysql: Refactor explain plan loop batch size (#5894) (f0fcd6b) (@cristiangreco) - database_observability.postgres: Cleanup embedded exporter collectors on reconnection (#6079) (f30d9ae) (@cristiangreco) - database_observability.postgres: Fix EXPLAIN param count when placeholders repeat (#6082) (b612b81) (@rgeyer) - database_observability: Drop schema_detection from logs (#6076) (b0105cb) (@cristiangreco) - database_observability: Ensure connection_info_monitor goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco) - deps: Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [SECURITY] (#6004) (38f4346) - deps: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (#5934) (a5154af) - deps: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (#6090) (0e59d64) - deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0 [SECURITY] (b44d51a) (@jharvey10) - deps: Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] (#6016) (d92c5c0) go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] (#6017) (e655bbc) - deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] (#6018) (94006e8) - deps: Update some minor go dep versions (#5896) (4ddd0ed) (@jharvey10) - go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8) (@x1unix) - go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix, @kalleep) - Helm: RBAC template handles empty rule arrays (#4860) (c9430e9) (@naptalie, @dehaansa, @kalleep) - loki.process: Eliminate per-stream goroutines in multiline stage (#6036) (c089e2e) (@kgeckhart) - loki.process: Prevent stage.structured_metadata from adding the same metadata several times (#5965) (0ec8a26) (@kalleep, @thampiotr) - loki.process: Wrap template in a custom type and move validation to syntax.Validator (#5910) (700dd7d) (@kalleep) - prometheus.exporter.postgres: Close DB connections on update (#6021) (8da97cf) (@kalleep) - prometheus.scrape: Update scrape_native_histograms to be updated at runtime (#6087) (18b205c) (@kalleep) - pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache (#5911) (03ca563) (@luweglarz) - pyroscope.ebpf: Move Pyroscope ebpf metrics registration after component error handling (#5540) (a3c57c0) (@crbednarz, @marcsanmi) - pyroscope: Set user agent on debuginfo connect-go client (#6022) (38ad1ef) (@korniltsev-grafanista) - ui: Large arguments are downloaded as files instead of rendered (#5268) (26c67b3) (@ptodev) - Update go-m1cpu v0.1.7 -> v0.2.1 to fix M5 chip crash (#6034) (7fa0cbc) (@ymotongpoo) - windows-installer: Increase service restart on failure delays (#5969) (add15b1) (@rknightion) - add script to package webassets inside a podman container, to not endanger or pollute the host system with npm - update to 1.15.1: goroutine exits on Stop * CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955) - update to 1.15.0: * BREAKING CHANGES - otelcol: Upgrade to OTel Collector v0.147.0 - Renamed undocumented metrics that was previously prefixed with <component_id><metric_name> to loki_source_awsfirehose<metric_name> * Security CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1 (bsc#1258609). - alloy-mixin: Add filters, groupBy, and multi-select dashboard variables - beyla.ebpf: Add support for Prometheus native histograms - beyla.ebpf: Bump Beyla to v3.6 - converters: Support converting Promtail limits_config - database_observability.mysql: Add filtering of query samples and wait events by minimum duration - database_observability.mysql: Embed prometheus exporter within db-o11y component - database_observability.postgres: Add configurable limit to pg_stat_statements query - database_observability.postgres: Embed prometheus exporter - database_observability: Promote components to stable - Expose Functionality to Handle syslogs with Empty MSG Field - loki.process: Support structured metadata as source type of stage.labels for loki.process - loki.secretfilter: Add sampling for secretfilter entries - loki.source.gcplog: Add alloy config for MaxOutstandingBytes and MaxOutstandingMessages - loki.write: Add loki pipeline latency metric - mixin: Update loki dashboard - otelcol.receiver.datadog: Expose intake proxy and trace_id_cache_size settings - prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default - pyroscope.ebpf: Add comm, pid labels and kernel frame options - update to 1.14.1: - Correctly handle the deprecated topic field in otelcol.receiver.kafka configuration - loki.process: Protect against json that does not look like docker json format - loki.source.file: Keep positions for compressed files when reading is finished - prometheus.scrape: Update arguments and targets even if scrape_native_histograms and extra_metrics are updated - update to 1.14.0: - loki.secretfilter: Some config options are removed entirely: partial_mask (replaced with redact_percent), allowlist (now controlled with custom gitleaks config), enable_entropy, include_generic, types (now controlled with custom gitleaks config). - otelcol.receiver.prometheus: otelcol.receiver.prometheus no longer sets start times of OTLP metrics. * Security: - update to 1.13.2: - Expose missing otelcol.processor.tail_sampling options - mixin: Add zipped dashboards as a release artifact - profiler: Backport Go 1.26 gopclntab textStart fix - prometheus.exporter.postgres: Update version of the exporter fork to fix pg_settings - pyroscope.ebpf: Backport dotnet nibble map fix - update to 1.13.1: - timeout before starting new ones - update to 1.13.0: - otelcol: Upgrade to OTel Collector v0.142.0 - otelcol.receiver.kafka: The global topic attribute has been deleted; use the topics attributes inside the logs, metrics, and traces blocks instead. - otelcol.exporter > sending_queue > batch > min_size changed from 8192 to 2000 and max_size changed from 0 to 3000 - Add a virtual_node_peer_attributes and virtual_node_extra_label arguments to otelcol.connector.servicegraph - Add an otelcol.processor.metric_start_time component - Add job level period, length, and add_cloudwatch_timestamp options and labels_snake_case to CW exporter - Add missing configuration parameter deployment_name_from_replicaset to k8sattributes processor - Add parcas symbols upload to pyroscope.ebpf - Add sharding for loki.write - Add unexposed otel engine and extension to codebase and change build structure - beyla.ebpf: Add meta_cache_address to beyla.ebpf.attributes.kubernetes - beyla.ebpf: Upgrade Beyla to v2.8.5 - Change the defaults for sending_queue > batch block inside otelcol.exporter components - cluster: Support DNS discovery mode prefixes in --cluster.join-addresses flag - converter: Update promtail converter to use file_match block for loki.source.file - database_observability: Add health check collector for postgres component - database_observability: Expose exclude_schemas and exclude_databases settings - database_observability: Support Azure cloud provider config data - database_observability.mysql: Support excluding schemas in all collectors - database_observability.postgres: Support excluding DBs in all collectors

Affected Systems

  • suse•alloy&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7

    < 1.16.1-150700.15.20.1

References (13)