alertmanager:0.27.0-3.3

alertmanager-0

bash

bash-sh

ca-certificates-mozilla-prebuilt

coreutils

glibc

gpg-pubkey

libacl1

libattr1

libcap2

libgcc_s1

libncurses6

libpcre1

libpcre2-8-0

libreadline7

libselinux1

libstdc++6

skelcd-EULA-bci

sles-release

terminfo-base

alertmanager:0.34.1-25.1

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

CVE-2026-56855

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

CVE-2026-78662

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.

CVE-2026-81870

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.
- Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
- mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

### Impact
An attacker can cause a complete outage of the gRPC server by sending a request missing both `:authority` and `Host` headers, provided they can successfully establish a transport connection.

### Patches
The issue has been addressed in `master` (and backported to `1.83.2` and `1.82.2`). The fix updates the HTTP/2 transport layer to reject requests missing both `:authority` and `Host` headers early, maintaining consistency with and other gRPC language implementations.

CVE-2026-84445

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

GO-2026-5932

	0.27.0-3.3	0.34.1-25.1
Details
Registered	2 years ago	3 days ago
Digest	a384bf5	ceb8571
Version	0.27.0	0.34.1
Revision	3.3	25.1
Base image	SLE BCI-micro 15.5.31.2	SLE BCI-micro 15.7-61.21
Operating System	SLE 15.5	SLE 15.7
Architecture	aarch64	aarch64
Size	19.9 MB	23.8 MB
System Packages
alertmanager-0	0.27.0-150500.2.1	0.34.1-150700.2.3
bash	4.4-150400.25.22	4.4-150400.27.6.1
bash-sh	4.4-150400.25.22	4.4-150400.27.6.1
ca-certificates-mozilla-prebuilt	2.68-150200.33.1	2.92-150200.50.3
coreutils	8.32-150400.9.6.1	8.32-150400.9.12.1
glibc	2.31-150300.86.3	2.38-150600.14.61.1
gpg-pubkey	-	3fa1d6ce-67c856ee
libacl1	2.2.52-4.3.1	2.4.0-150000.4.6.1
libattr1	2.4.47-2.19	2.6.0-150000.4.3.1
libcap2	2.63-150400.3.3.1	2.63-150400.3.6.1
libgcc_s1	13.3.0+git8781-150000.1.12.1	16.2.0+git9497-150000.1.3.3
libncurses6	6.1-150000.5.27.1	6.1-150000.5.33.1
libpcre1	8.45-150000.20.13.1	Removed
libpcre2-8-0	-	10.42-150600.3.3.1
libreadline7	7.0-150400.25.22	7.0-150400.27.6.1
libselinux1	3.1-150400.1.69	3.5-150600.3.3.1
libstdc++6	13.3.0+git8781-150000.1.12.1	16.2.0+git9497-150000.1.3.3
skelcd-EULA-bci	2023.03.06-150500.2.1	20250430-150700.1.1
sles-release	15.5-150500.61.4.1	15.7-150700.67.6.1
terminfo-base	6.1-150000.5.27.1	6.1-150000.5.33.1
Vulnerabilities
CVE-2023-45288	Found	Fixed
CVE-2026-78669	Not present	Found
CVE-2026-84445	Not present	Found Not affected
CVE-2024-24786	Found	Fixed
CVE-2026-56855	Not present	Found Not affected
CVE-2026-78659	Not present	Found
CVE-2026-78660	Not present	Found
CVE-2026-78662	Not present	Found Not affected
CVE-2026-78663	Not present	Found
CVE-2026-97032	Not present	Found
GHSA-mh55-gqvf-xfwm	Found	Fixed
CVE-2026-81870	Not present	Found Not affected
GO-2026-5932	Not present	Found Not affected
OCI Annotations
org.opencontainers.image.base.digest	sha256:ad9d669f870fb5e6632f14f7782934c13889e220016726859480b341c3800ab7	sha256:a0255639ce95d4197bb708aaee637f830a545561c1d8c13d06ddde763c922977
org.opencontainers.image.base.name	registry.suse.com/bci/bci-micro:15.5.31.2	registry.suse.com/bci/bci-micro:15.7-61.21

alertmanager

These are the differences found between the artifacts selected