Linux · openSUSE Leap · Security advisory · August 10, 2026

OPENSUSE-SU-2026:21551-1: govulncheck-vulndb security update

OPENSUSE-SU-2026:21551-1, released August 10, 2026, fixes 77 CVEs in govulncheck-vulndb (version 0.0.20260727T201416-160000.1.1). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
77
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0224
83rd percentile

Priority of the 77 CVEs

Patch now 0 Urgent 0 High 19 Routine 58

Fixed package versions

ProductReleaseFixed in
govulncheck-vulndbopensuse-leap 16.00.0.20260727T201416-160000.1.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-29181 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)7.5 0.0082 None reported
High CVE-2026-45135 caddy: Caddy is an extensible server platform that uses TLS by default8.1 0.0068 None reported
High CVE-2026-52844 caddy: Caddy is an extensible server platform that uses TLS by default7.5 0.0062 None reported
High CVE-2026-41643 govulncheck-vulndb: GO-2026-5266 GHSA-8rxh-r2p6-7f2q7.5 0.0054 None reported
High CVE-2026-41642 govulncheck-vulndb: GO-2026-5198 GHSA-7235-89m6-f4px7.5 0.0050 None reported
High CVE-2026-52845 caddy: Caddy is an extensible server platform that uses TLS by default8.1 0.0045 None reported
High CVE-2026-40611 govulncheck-vulndb: GO-2026-5593 GHSA-qqx8-2xmm-jrv88.8 0.0042 None reported
High CVE-2026-42285 govulncheck-vulndb: GO-2026-5525 GHSA-p3w2-64xm-833j7.5 0.0042 None reported
High CVE-2026-50163 golang-oras-oras-go: oras-go is a Go library for managing OCI artifacts7.1 0.0040 None reported
High CVE-2026-44740 golang-github-go-git-go-billy-v6: Billy is an interface filesystem abstraction for Go7.5 0.0039 None reported
High CVE-2026-50151 golang-oras-oras-go: oras-go is a Go library for managing OCI artifacts7.5 0.0038 None reported
High CVE-2026-40890 github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer7.5 0.0035 None reported
High CVE-2026-41178 alloy: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS8.2 0.0034 None reported
High CVE-2026-44973 golang-github-go-git-go-billy-v6: Billy is an interface filesystem abstraction for Go8.1 0.0031 None reported
High CVE-2026-37462 govulncheck-vulndb: GO-2026-5971 GHSA-pw7p-7fqv-hpj87.5 0.0028 None reported
High CVE-2026-44301 govulncheck-vulndb: GO-2026-5740 GHSA-x597-9fr4-58578.1 0.0027 None reported
High CVE-2026-41506 amazon-ssm-agent: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during7.4 0.0026 None reported
High CVE-2026-45022 govulncheck-vulndb: GO-2026-5074 GHSA-389r-gv7p-r3rp7.5 0.0016 None reported
High CVE-2026-42306 docker.io: Moby is an open source container framework7.2 0.0010 None reported
Routine CVE-2026-7482 govulncheck-vulndb: GO-2026-5748 GHSA-x8qc-fggm-mpqgn/a 0.0224 None reported
Routine CVE-2026-32952 govulncheck-vulndb: GO-2026-5543 GHSA-pjcq-xvwq-hhpjn/a 0.0103 None reported
Routine CVE-2026-7020 govulncheck-vulndb: GO-2026-5750 GHSA-x99g-8v8j-25j2n/a 0.0091 None reported
Routine CVE-2026-50274 govulncheck-vulndb: GO-2026-6000 GHSA-74j5-xf3v-crq8n/a 0.0079 None reported
Routine CVE-2026-25038 govulncheck-vulndb: GO-2026-6076 GHSA-v73x-hx65-6pf4n/a 0.0062 None reported
Routine CVE-2026-46385 govulncheck-vulndb: GO-2026-5046 GHSA-w8j3-pq8g-8m7wn/a 0.0061 None reported
Showing 1 to 25 of 77 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.