Linux · openSUSE Leap · Security advisory · July 6, 2026

OPENSUSE-SU-2026:21210-1: google-osconfig-agent security update

OPENSUSE-SU-2026:21210-1, released July 6, 2026, fixes 21 CVEs in google-osconfig-agent (version 20260615.01-160000.1.2). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
21
1 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.8946
99th percentile

Priority of the 21 CVEs

Patch now 0 Urgent 1 High 16 Routine 4

Fixed package versions

ProductReleaseFixed in
google-osconfig-agentopensuse-leap 16.020260615.01-160000.1.2

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 0.0056 None reported
High CVE-2023-45288 golang-github-prometheus-alertmanager: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)7.5 0.8946 None reported
High CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 0.0691 None reported
High CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path9.1 0.0162 None reported
High CVE-2025-22868 cosign: cosign: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token parsing (bsc#1239204)7.5 0.0087 None reported
High CVE-2026-33814 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 0.0084 None reported
High CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 0.0068 None reported
High CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 0.0068 None reported
High CVE-2026-34986 rh-podman-desktop: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including...9.1 0.0066 None reported
High CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 0.0060 None reported
High CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh8.7 0.0050 None reported
High CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 0.0048 None reported
High CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 0.0047 None reported
High CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 0.0047 None reported
High CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh8.7 0.0047 None reported
High CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh8.8 0.0037 None reported
High CVE-2026-41506 amazon-ssm-agent: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during7.4 0.0026 None reported
Routine CVE-2025-47911 alloy: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML documents5.3 0.0056 None reported
Routine CVE-2025-58190 alloy: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially5.3 0.0054 None reported
Routine CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 0.0041 None reported
Routine CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 0.0028 None reported
Showing 1 to 21 of 21 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.