OPENSUSE-SU-2026:22027-1

Vulnerability from csaf_opensuse - Published: 2026-10-06 12:18 - Updated: 2026-10-08 18:03
Summary
Security update for golang-github-prometheus-alertmanager
Severity
Important
Notes
Title of the patch: Security update for golang-github-prometheus-alertmanager
Description of the patch: This update for golang-github-prometheus-alertmanager fixes the following issues: Changes in golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.57.0 (bsc#1266615) - Update to version 0.33.1 (jsc#PED-16708): * [BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily. * [BUGFIX] silence with no matchers should populate an empty array in API response - Update to version 0.33.0: * The '--enable-feature=auto-gomaxprocs' option has been removed. * Add a new Microsoft Teams integration that supports adaptive cards. * Add support for AWS Signature V4 to call AWS services that require authentication. * Add support for Google Chat as a notification channel. * Add support for custom payloads in webhooks. - Update to version 0.32.2: * [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap. - Update to version 0.32.1: * [BUGFIX] dispatcher: Fix issue with dispatching to a contended route. - Update to version 0.32.0: * Reduce memory allocations through pre-sizing collections and batch allocation. * CVE-2026-2303: Removed indirect dep on vulnerable mongodb driver (bsc#1269834) - Update to version 0.31.1: * No user-visible changes - Update to version 0.31.0: * Add full payload templating support for webhook notifier. * Add support for UTF-8 label names in UI matchers. * Fix escaping for matcher values with quotes in the UI. - Update to version 0.30.1: * [BUGFIX] Fix memory leak in tracing client. - Update to version 0.30.0: * Add Mattermost integration. * Add support for Slack apps. * Add distributed tracing support. * Add names to inhibition rules. * Add templating functions for working with URLs and JSON. * Allow persistent peer names in a cluster. - Update to version 0.29.0: * Add incident.io notifier. * Add monospace message formatting. * Update Jira notifier to support both Jira cloud API v3 and Jira datacenter API v2.
Patchnames: openSUSE-Leap-16.0-packagehub-655
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-2303
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-39821
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-2303
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for golang-github-prometheus-alertmanager",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for golang-github-prometheus-alertmanager fixes the following issues:\n\nChanges in golang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.57.0 (bsc#1266615)\n\n- Update to version 0.33.1 (jsc#PED-16708):\n  * [BUGFIX] silences: fix silences snapshot missing legacy\n    matchers field. This caused a bug that prevented older\n    alertmanager versions from reading newer snapshots\n    unnecessarily.\n  * [BUGFIX] silence with no matchers should populate an empty\n    array in API response\n\n- Update to version 0.33.0:\n  * The \u0027--enable-feature=auto-gomaxprocs\u0027 option has been\n    removed.\n  * Add a new Microsoft Teams integration that supports adaptive\n    cards.\n  * Add support for AWS Signature V4 to call AWS services that\n    require authentication.\n  * Add support for Google Chat as a notification channel.\n  * Add support for custom payloads in webhooks.\n\n- Update to version 0.32.2:\n  * [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup\n    swap.\n\n- Update to version 0.32.1:\n  * [BUGFIX] dispatcher: Fix issue with dispatching to a contended\n    route.\n\n- Update to version 0.32.0:\n  * Reduce memory allocations through pre-sizing collections and\n    batch allocation.\n  * CVE-2026-2303: Removed indirect dep on vulnerable mongodb\n                   driver (bsc#1269834)\n\n- Update to version 0.31.1:\n  * No user-visible changes\n\n- Update to version 0.31.0:\n  * Add full payload templating support for webhook notifier.\n  * Add support for UTF-8 label names in UI matchers.\n  * Fix escaping for matcher values with quotes in the UI.\n\n- Update to version 0.30.1:\n  * [BUGFIX] Fix memory leak in tracing client.\n\n- Update to version 0.30.0:\n  * Add Mattermost integration.\n  * Add support for Slack apps.\n  * Add distributed tracing support.\n  * Add names to inhibition rules.\n  * Add templating functions for working with URLs and JSON.\n  * Allow persistent peer names in a cluster.\n\n- Update to version 0.29.0:\n  * Add incident.io notifier.\n  * Add monospace message formatting.\n  * Update Jira notifier to support both Jira cloud API v3 and\n    Jira datacenter API v2.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-655",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22027-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266615",
        "url": "https://bugzilla.suse.com/1266615"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1269834",
        "url": "https://bugzilla.suse.com/1269834"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-2303 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-2303/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      }
    ],
    "title": "Security update for golang-github-prometheus-alertmanager",
    "tracking": {
      "current_release_date": "2026-10-08T18:03:00Z",
      "generator": {
        "date": "2026-10-06T12:18:35Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:22027-1",
      "initial_release_date": "2026-10-06T12:18:35Z",
      "revision_history": [
        {
          "date": "2026-10-06T12:18:35Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-08T18:03:00Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
                "product": {
                  "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
                  "product_id": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:prometheus:alertmanager:0.33.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/golang-github-prometheus-alertmanager@0.33.1-bp160.1.1?arch=aarch64\u0026upstream=golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
                  "product_id": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:prometheus:alertmanager:0.33.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/golang-github-prometheus-alertmanager@0.33.1-bp160.1.1?arch=ppc64le\u0026upstream=golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
                "product": {
                  "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
                  "product_id": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:prometheus:alertmanager:0.33.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/golang-github-prometheus-alertmanager@0.33.1-bp160.1.1?arch=s390x\u0026upstream=golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64",
                "product": {
                  "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64",
                  "product_id": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:prometheus:alertmanager:0.33.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/golang-github-prometheus-alertmanager@0.33.1-bp160.1.1?arch=x86_64\u0026upstream=golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64"
        },
        "product_reference": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le"
        },
        "product_reference": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x"
        },
        "product_reference": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
        },
        "product_reference": "golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-2303",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-2303"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The mongo-go-driver repository  contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-2303",
          "url": "https://www.suse.com/security/cve/CVE-2026-2303"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268652 for CVE-2026-2303",
          "url": "https://bugzilla.suse.com/1268652"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T12:18:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-2303"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0:0.33.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-06T12:18:35Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.