{"id":"openSUSE-SU-2026:21927-1","summary":"Security update for apptainer","details":"This update for apptainer fixes the following issues:\n\nChanges in apptainer:\n\n- Fix potential authentication bypass and deadlocks in the\n  crypto/ssh library by updating golang.org/x/crypto to v0.56.0.\n  CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666)\n- Fix\n  * a potential DoS via crash due to missing ':authority' and\n    'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033),\n  * a potential heap memory exhaustion via HTTP/2 DATA frame\n     fragmentation CVE-2026-84304 (bsc#1279236),\n  * a potential bypass of authorization policies via mixed-case\n    or canonical-case header matches due to an xDS RBAC HTTP filter\n    implementation issue CVE-2026-84303 (bsc#1279333)\n  by updating google.golang.org/grpc to v1.83.2\n","modified":"2026-09-25T18:23:54.031701340Z","published":"2026-09-21T13:53:22Z","related":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"],"upstream":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1278666"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279033"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279333"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56854"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56855"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78662"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84303"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84304"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84445"}],"affected":[{"package":{"name":"apptainer","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/apptainer&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-bp160.4.1"}]}],"ecosystem_specific":{"binaries":[{"apptainer":"1.5.3-bp160.4.1","apptainer-leap":"1.5.3-bp160.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21927-1.json"}}],"schema_version":"1.9.0"}