SUSE-SU-2026:3057-1

Advisory lineage Upstream: 11 Downstream: 0
Published: 15 Jul 2026, 13:30
Last modified:16 Jul 2026, 10:00

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Jul 2026, 13:30
Published
Vulnerability first disclosed
16 Jul 2026, 10:00
Last Modified
Vulnerability information updated

Description

Security update for terraform-provider-susepubliccloud This update for terraform-provider-susepubliccloud fixes the following issues - CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300). - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path` pseudo-header (bsc#1260180). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477). - CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer overflow (bsc#1263515). - CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host mismatch (bsc#1263606). - CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445). - CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411). - CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357). - CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263316). - CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).

Affected Systems

  • suse•terraform-provider-susepubliccloud&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4

    < 0.0.1-150100.3.14.1

  • suse•terraform-provider-susepubliccloud&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5

    < 0.0.1-150100.3.14.1

References (22)