SUSE Package Hub - openSUSE-2026-224

Update Info

openSUSE-2026-224

Security update for cadvisor

Type: security

Severity: important

Issued: 2026-07-01

Description:

This update for cadvisor fixes the following issues:

- CVE-2026-39821: Update golang.org/x/net/idna reference (boo#1266645).
- CVE-2026-33186: Update google.golang.org/grpc reference (boo#1260305).
- CVE-2024-45310: Update github.com/opencontainers/runc/libcontainer/utils reference (boo#1257429).
- CVE-2026-10722: Update github.com/cilium/ebpf reference (boo#1267788).

References

CVE: CVE-2026-39821
CVE: CVE-2026-33186
CVE: CVE-2026-10722
CVE: CVE-2024-45310
Bugzilla: 1267788 VUL-0: CVE-2026-10722: cadvisor: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing malformed ELF/BTF input
Bugzilla: 1266645 VUL-0: CVE-2026-39821: cadvisor: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation
Bugzilla: 1260305 VUL-0: CVE-2026-33186: cadvisor: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header
Bugzilla: 1257429 VUL-0: CVE-2024-45310: cadvisor: github.com/opencontainers/runc/libcontainer/utils: runc can be tricked into creating empty files/directories on host

Packages

cadvisor-0.60.3-bp157.2.3.1