SUSE-SU-2026:4392-1: cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise

CVSS: UnknownPublished

Published 29-09-2026Last modified 30-09-2026

Vulnerability summary

SUSE-SU-2026:4392-1 is a vulnerability in cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise with no CVSS score yet.

Overall risk

0/100

0100

Minimal · default modelHow is this calculated?

CVSS score

Not scored

010

No CVSS score recorded

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 6 · Downstream 0 · Related 6

CVE-2026-56852 CVE-2026-56854 CVE-2026-56855 CVE-2026-56864 CVE-2026-78662 CVE-2026-84304

Timeline

29-09-2026
PublishedVulnerability first disclosed.
30-09-2026
Last modifiedVulnerability information updated.

Description

Security update for cosign This update for cosign fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215). - Verification bypass via public key in legacy bundle (bsc#1282542). Changes for cosign: - update to 3.1.3: * Auto-detect default digest algorithm for public keys * fix(pkcs11key): return an error instead of panicking when no key pair matches * Supporting OCI Signing with X.509 Certificate Chain * fix: prevent shell completions for various options not taking filenames * fix(blob): compare file checksums case-insensitively in * Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98, bsc#1282542)

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse11 products

cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.1.3-150400.3.57.1
cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.1.3-150400.3.57.1
cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 3.1.3-150400.3.57.1
cosign&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 3.1.3-150400.3.57.1
cosign&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 3.1.3-150400.3.57.1