SUSE Package Hub - SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2823

Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2823

Security update for helm

Type: security

Severity: important

Issued: 2026-07-09

Description:

This update for helm fixes the following issues

- Update to version 3.21.2
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).

References

CVE: CVE-2026-48978
CVE: CVE-2026-39821
Bugzilla: 1270127 VUL-0: CVE-2026-48978: helm: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
Bugzilla: 1266598 VUL-0: CVE-2026-39821: helm: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation

Packages

helm-3.21.2-150000.1.80.1