Linux · openSUSE Leap · Security advisory · September 4, 2026

OPENSUSE-SU-2026:21761-1: govulncheck-vulndb security update

OPENSUSE-SU-2026:21761-1, released September 4, 2026, fixes 181 CVEs in govulncheck-vulndb (version 0.0.20260827T195228-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
181
4 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0859
95th percentile

Priority of the 181 CVEs

Patch now 0 Urgent 4 High 23 Routine 154

Fixed package versions

ProductReleaseFixed in
govulncheck-vulndbopensuse-leap 16.00.0.20260827T195228-160000.1.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna10.0 0.0183 None reported
Urgent CVE-2026-34178 govulncheck-vulndb: GO-2026-5576 GHSA-q96j-3fmm-7fv49.1 0.0043 None reported
Urgent CVE-2026-34177 govulncheck-vulndb: GO-2026-5368 GHSA-fm2x-c5qw-4h6f9.1 0.0037 None reported
Urgent CVE-2026-34179 govulncheck-vulndb: GO-2026-5306 GHSA-c3h3-89qf-jqm59.1 0.0028 None reported
High CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 0.0691 None reported
High CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 0.0068 None reported
High CVE-2026-33818 Enforce maximum recursion depth in encoding/asn18.8 0.0057 None reported
High CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http8.8 0.0057 None reported
High CVE-2026-56859 Add recursion depth guard during decode in encoding/xml8.8 0.0057 None reported
High CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls8.8 0.0057 None reported
High CVE-2026-59733 govulncheck-vulndb: GO-2026-6195 GHSA-fqj9-69pf-6pjgn/a 0.0055 None reported
High CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url8.8 0.0055 None reported
High CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage7.5 0.0055 None reported
High CVE-2026-55677 osbuild-composer: Echo is a Go web framework8.2 0.0052 None reported
High CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text8.8 0.0048 None reported
High CVE-2026-35172 docker-registry: Distribution is a toolkit to pack, ship, store, and deliver container content7.5 0.0047 None reported
High CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 0.0047 None reported
High CVE-2026-17106 Tar extraction in moby/go-archive can write outside the destination directory via link following8.8 0.0044 None reported
High CVE-2026-46603 golang-golang-x-image: VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L im...7.5 0.0041 None reported
High CVE-2026-54572 govulncheck-vulndb: GO-2026-6191 GHSA-cf44-9pgv-m4xcn/a 0.0040 None reported
High CVE-2026-73500 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlinen/a 0.0040 None reported
High CVE-2026-71556 go-git: Worktree operations may follow symlinks7.1 0.0036 None reported
High CVE-2026-56858 Fix Javascript regexp context tracking in html/template8.8 0.0031 None reported
High CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb7.5 0.0030 None reported
High CVE-2026-71313 govulncheck-vulndb: GO-2026-6186 GHSA-7p4m-qxvv-g567n/a 0.0030 None reported
Showing 1 to 25 of 181 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.