Most recent entries from all

ALSA-2026:46391 — Important: grafana security, bug fix, and enhancement update

Affected: AlmaLinux:8: grafana, AlmaLinux:8: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

* [grafana / almalinux-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn: CLEANSTART-2026-AQ65185 — Security fixes for CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-61727, CVE-2025-61729, CVE-2026-1229, CVE-2…

Withdrawn by the publisher.

Affected: CleanStart: terragrunt-fips

Multiple security vulnerabilities affect the terragrunt-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-323552

fkie_cve-2026-44740

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

GHSA-m3xc-h892-ggx6 — go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Affected: Go: github.com/go-git/go-billy/v5, Go: github.com/go-git/go-billy/v6

### Impact Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-billy` version.

### Credits Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

openSUSE-SU-2026:10856-1 — rclone-1.74.2-1.1 on GA media

rclone-1.74.2-1.1 on GA media

RHSA-2026:32963 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

RLSA-2026:46391 — Important: grafana security, bug fix, and enhancement update

Affected: Rocky Linux:8: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22157-1 — Security update for amazon-ssm-agent

Security update for amazon-ssm-agent

UBUNTU-CVE-2026-44740

Affected: Ubuntu:22.04:LTS: golang-github-go-git-go-billy, Ubuntu:24.04:LTS: golang-github-go-git-go-billy, Ubuntu:25.10: golang-github-go-git-go-billy, Ubuntu:26.04:LTS: golang-github-go-git-go-billy

WID-SEC-W-2026-2520 — Red Hat Enterprise Linux (go-billy): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.