prometheus-pushgateway:1.10.0-2.8

bash

bash-sh

ca-certificates-mozilla-prebuilt

coreutils

glibc

gpg-pubkey

libacl1

libattr1

libcap2

libgcc_s1

libncurses6

libpcre1

libpcre2-8-0

libreadline7

libselinux1

libstdc++6

prometheus-pushgateway-1

skelcd-EULA-bci

sles-release

terminfo-base

prometheus-pushgateway:1.11.3-19.1

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVE-2026-46600

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVE-2026-56852

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

CVE-2026-56854

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

CVE-2026-56855

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

CVE-2026-78662

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

GO-2026-5932

	1.10.0-2.8	1.11.3-19.1
Details
Registered	2 years ago	13 days ago
Digest	a3aed03	1f08c18
Version	1.10.0	1.11.3
Revision	2.8	19.1
Base image	SLE BCI-micro 15.5.32.1	SLE BCI-micro 15.7-61.11
Operating System	SLE 15.5	SLE 15.7
Architecture	x86_64	x86_64
Size	17.7 MB	18.6 MB
System Packages
bash	4.4-150400.25.22	4.4-150400.27.6.1
bash-sh	4.4-150400.25.22	4.4-150400.27.6.1
ca-certificates-mozilla-prebuilt	2.68-150200.33.1	2.84-150200.44.1
coreutils	8.32-150400.9.6.1	8.32-150400.9.12.1
glibc	2.31-150300.86.3	2.38-150600.14.58.1
gpg-pubkey	-	3fa1d6ce-67c856ee
libacl1	2.2.52-4.3.1	2.4.0-150000.4.6.1
libattr1	2.4.47-2.19	2.6.0-150000.4.3.1
libcap2	2.63-150400.3.3.1	2.63-150400.3.6.1
libgcc_s1	13.3.0+git8781-150000.1.12.1	15.3.0+git11272-150000.1.12.1
libncurses6	6.1-150000.5.27.1	6.1-150000.5.33.1
libpcre1	8.45-150000.20.13.1	Removed
libpcre2-8-0	-	10.42-150600.3.3.1
libreadline7	7.0-150400.25.22	7.0-150400.27.6.1
libselinux1	3.1-150400.1.69	3.5-150600.3.3.1
libstdc++6	13.3.0+git8781-150000.1.12.1	15.3.0+git11272-150000.1.12.1
prometheus-pushgateway-1	1.10.0-150500.1.1	1.11.3-150700.2.6
skelcd-EULA-bci	2023.03.06-150500.2.1	20250430-150700.1.1
sles-release	15.5-150500.61.4.1	15.7-150700.67.6.1
terminfo-base	6.1-150000.5.27.1	6.1-150000.5.33.1
Vulnerabilities
CVE-2026-46600	Not present	Found Not affected
CVE-2026-56852	Not present	Found Not affected
CVE-2026-56854	Not present	Found Not affected
CVE-2026-56855	Not present	Found Not affected
CVE-2026-78662	Not present	Found Not affected
GO-2026-5932	Not present	Found Not affected
OCI Annotations
org.opencontainers.image.base.digest	sha256:9c283404b927781e9362ce8384d855f1e7ad605912e41a262a39202fd4f7ab7a	sha256:52cd5d552529b8f05d86496cc7452e74d338a8542fff899a25617e783fa4bd6c
org.opencontainers.image.base.name	registry.suse.com/bci/bci-micro:15.5.32.1	registry.suse.com/bci/bci-micro:15.7-61.11

prometheus-pushgateway

These are the differences found between the artifacts selected