UnratedFix available

Security update for alloy

Type: advisorySources: OSV

This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861). - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742). - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482). - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483). - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484). - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486). - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487). - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a pa

Products: alloy
Affected versions: Not specified
Fixed versions: 1.19.2-160000.1.1
CVEs: CVE-2026-2303, CVE-2026-37236, CVE-2026-41178, CVE-2026-45679, CVE-2026-45680, CVE-2026-45681, CVE-2026-45683, CVE-2026-45684, CVE-2026-46600, CVE-2026-48496, CVE-2026-56852, CVE-2026-56854, CVE-2026-56855, CVE-2026-71556, CVE-2026-71557, CVE-2026-75889, CVE-2026-78662, CVE-2026-81521, CVE-2026-89090
Confirmed fixed CVEs: Not specified
Updated in this feed: 30 Oct 2026, 21:43 UTC · Revision 1

Source evidence

Security update for alloy

core-osv · Original source

Published 6 Oct 2026, 13:07 UTC

osv:SUSE-SU-2026:24148-1

alloy

Fixed versions: 1.19.2-160000.1.1

alloy

Fixed versions: 1.19.2-160000.1.1

Complete source record

{
  "id": "8f2ef884bc012e3a08570d209838caba3f1b563371ac5a8351deb3c4aaa08536",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A24148-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for alloy",
    "summary": "This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling (bsc#1269861). - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996). - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742). - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482). - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause a DoS (bsc#1267483). - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and can cause OBI out-of-bounds reads to leak memory into telemetry (bsc#1267484). - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel memory and cause that memory to be copied into telemetry (bsc#1267486). - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-segment calls to read and overwrite memory beyond the first segment (bsc#1267487). - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the size of a pa",
    "evidence": "osv:SUSE-SU-2026:24148-1",
    "products": [
      {
        "name": {
          "value": "alloy",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.19.2-160000.1.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "alloy",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.19.2-160000.1.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:24148-1",
      "aliases": [
        "SUSE-SU-2026:24148-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.19.2-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "alloy",
            "purl": "pkg:rpm/suse/alloy&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24148-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "alloy": "1.19.2-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.19.2-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "alloy",
            "purl": "pkg:rpm/suse/alloy&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24148-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "alloy": "1.19.2-160000.1.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-16T17:23:10.706600173Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-2303",
        "CVE-2026-37236",
        "CVE-2026-41178",
        "CVE-2026-45679",
        "CVE-2026-45680",
        "CVE-2026-45681",
        "CVE-2026-45683",
        "CVE-2026-45684",
        "CVE-2026-46600",
        "CVE-2026-48496",
        "CVE-2026-56852",
        "CVE-2026-56854",
        "CVE-2026-56855",
        "CVE-2026-71556",
        "CVE-2026-71557",
        "CVE-2026-75889",
        "CVE-2026-78662",
        "CVE-2026-81521",
        "CVE-2026-89090"
      ],
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-202624148-1/",
        "https://bugzilla.suse.com/1267482",
        "https://bugzilla.suse.com/1267483",
        "https://bugzilla.suse.com/1267484",
        "https://bugzilla.suse.com/1267486",
        "https://bugzilla.suse.com/1267487",
        "https://bugzilla.suse.com/1268982",
        "https://bugzilla.suse.com/1269861",
        "https://bugzilla.suse.com/1272028",
        "https://bugzilla.suse.com/1272418",
        "https://bugzilla.suse.com/1276742",
        "https://bugzilla.suse.com/1276982",
        "https://bugzilla.suse.com/1276992",
        "https://bugzilla.suse.com/1277429",
        "https://bugzilla.suse.com/1277996",
        "https://bugzilla.suse.com/1278671",
        "https://bugzilla.suse.com/1278693",
        "https://bugzilla.suse.com/1280671",
        "https://www.suse.com/security/cve/CVE-2026-2303",
        "https://www.suse.com/security/cve/CVE-2026-37236",
        "https://www.suse.com/security/cve/CVE-2026-41178",
        "https://www.suse.com/security/cve/CVE-2026-45679",
        "https://www.suse.com/security/cve/CVE-2026-45680",
        "https://www.suse.com/security/cve/CVE-2026-45681",
        "https://www.suse.com/security/cve/CVE-2026-45683",
        "https://www.suse.com/security/cve/CVE-2026-45684",
        "https://www.suse.com/security/cve/CVE-2026-46600",
        "https://www.suse.com/security/cve/CVE-2026-48496",
        "https://www.suse.com/security/cve/CVE-2026-56852",
        "https://www.suse.com/security/cve/CVE-2026-56854",
        "https://www.suse.com/security/cve/CVE-2026-56855",
        "https://www.suse.com/security/cve/CVE-2026-71556",
        "https://www.suse.com/security/cve/CVE-2026-71557",
        "https://www.suse.com/security/cve/CVE-2026-75889",
        "https://www.suse.com/security/cve/CVE-2026-78662",
        "https://www.suse.com/security/cve/CVE-2026-81521",
        "https://www.suse.com/security/cve/CVE-2026-89090"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-2303",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-37236",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-41178",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45679",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45680",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45681",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45683",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45684",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-46600",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-48496",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56852",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56854",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56855",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-71556",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-71557",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-75889",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-78662",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-81521",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-89090",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 344602,
  "published_at": "2026-10-06T13:07:44+00:00"
}