OPENSUSE-SU-2026:22026-1

Vulnerability from csaf_opensuse - Published: 2026-10-06 11:04 - Updated: 2026-10-08 18:02
Summary
Security update for prometheus-blackbox_exporter
Severity
Important
Notes
Title of the patch: Security update for prometheus-blackbox_exporter
Description of the patch: This update for prometheus-blackbox_exporter fixes the following issues: Changes in prometheus-blackbox_exporter: - CVE-2026-84304: Fix heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 (bsc#1279126) - CVE-2026-39821: Fix potential validation bypass and privilege escalation by bumping golang.org/x/net to version 0.57.0 (bsc#1266556) - CVE-2026-39821: Bump golang.org/x/net to version 0.55.0 (bsc#1266556) - Build only for SUSE distributions - Upgrade to version 0.26.0 (jsc#PED-12872): * Changes: Replace go-kit/log with log/slog module. * Features: Add metric to record tls ciphersuite negotiated during handshake. Add a way to export labels with content matched by the probe. Reports Certificate Serial number. * Enhancement: Add stale workflow to start sync with stale.yaml in Prometheus. * Bug fixes: Only register grpc TLS metrics on successful handshake. - Upgrade to version 0.25.0: * Features: Allow to get Probe logs by target. Log errors from probe. * Bug fixes: Prevent logging confusing error message. Explicit registration of internal exporter metrics. - Security: * CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238680) * CVE-2023-45288: Fix closing connections when receiving too many headers (bsc#1236515)
Patchnames: openSUSE-Leap-16.0-packagehub-654
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
Affected products
Recommended 4 products, the same list as for CVE-2023-45288
Threats
Impact moderate
Affected products
Recommended 4 products, the same list as for CVE-2023-45288
Threats
Impact important
Affected products
Recommended 4 products, the same list as for CVE-2023-45288
Threats
Impact important

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for prometheus-blackbox_exporter",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for prometheus-blackbox_exporter fixes the following issues:\n\nChanges in prometheus-blackbox_exporter:\n\n- CVE-2026-84304: Fix heap memory exhaustion (OOM) via HTTP/2 DATA\n                  frame fragmentation in gRPC-Go by bumping it to\n                  version 1.83.1 (bsc#1279126)\n\n- CVE-2026-39821: Fix potential validation bypass and privilege\n                  escalation by bumping golang.org/x/net to version\n                  0.57.0 (bsc#1266556)\n\n- CVE-2026-39821: Bump golang.org/x/net to version 0.55.0 (bsc#1266556)\n\n- Build only for SUSE distributions\n\n- Upgrade to version 0.26.0 (jsc#PED-12872):\n  * Changes:\n    Replace go-kit/log with log/slog module.\n  * Features:\n    Add metric to record tls ciphersuite negotiated during\n      handshake.\n    Add a way to export labels with content matched by the probe.\n    Reports Certificate Serial number.\n  * Enhancement:\n    Add stale workflow to start sync with stale.yaml in Prometheus.\n  * Bug fixes:\n    Only register grpc TLS metrics on successful handshake.\n\n- Upgrade to version 0.25.0:\n  * Features:\n    Allow to get Probe logs by target.\n    Log errors from probe.\n  * Bug fixes:\n    Prevent logging confusing error message.\n    Explicit registration of internal exporter metrics.\n\n- Security:\n  * CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238680)\n  * CVE-2023-45288: Fix closing connections when receiving too many headers (bsc#1236515)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-654",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22026-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236515",
        "url": "https://bugzilla.suse.com/1236515"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1238680",
        "url": "https://bugzilla.suse.com/1238680"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266556",
        "url": "https://bugzilla.suse.com/1266556"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1279126",
        "url": "https://bugzilla.suse.com/1279126"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22870 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84304 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84304/"
      }
    ],
    "title": "Security update for prometheus-blackbox_exporter",
    "tracking": {
      "current_release_date": "2026-10-08T18:02:59Z",
      "generator": {
        "date": "2026-10-06T11:04:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:22026-1",
      "initial_release_date": "2026-10-06T11:04:02Z",
      "revision_history": [
        {
          "date": "2026-10-06T11:04:02Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-08T18:02:59Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
                "product": {
                  "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
                  "product_id": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/prometheus-blackbox_exporter@0.26.0-bp160.1.1?arch=aarch64\u0026upstream=prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
                "product": {
                  "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
                  "product_id": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/prometheus-blackbox_exporter@0.26.0-bp160.1.1?arch=ppc64le\u0026upstream=prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
                "product": {
                  "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
                  "product_id": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/prometheus-blackbox_exporter@0.26.0-bp160.1.1?arch=s390x\u0026upstream=prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64",
                "product": {
                  "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64",
                  "product_id": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/prometheus-blackbox_exporter@0.26.0-bp160.1.1?arch=x86_64\u0026upstream=prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64"
        },
        "product_reference": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le"
        },
        "product_reference": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x"
        },
        "product_reference": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
        },
        "product_reference": "prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T11:04:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2025-22870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22870",
          "url": "https://www.suse.com/security/cve/CVE-2025-22870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238572 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238611 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T11:04:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22870"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T11:04:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-84304",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84304"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84304",
          "url": "https://www.suse.com/security/cve/CVE-2026-84304"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278271 for CVE-2026-84304",
          "url": "https://bugzilla.suse.com/1278271"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-84304",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:prometheus-blackbox_exporter-0:0.26.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T11:04:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-84304"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…