metallb-speaker:0.14.5-6.9

bash

bash-sh

ca-certificates-mozilla-prebuilt

coreutils

glibc

gpg-pubkey

libacl1

libattr1

libcap2

libgcc_s1

libncurses6

libpcre1

libpcre2-8-0

libreadline7

libselinux1

libstdc++6

metallb-speaker-0

skelcd-EULA-bci

sles-release

terminfo-base

metallb-speaker:0.16.1-26.1

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVE-2026-46600

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVE-2026-56852

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

CVE-2026-84303

The function `ext.NativeTypes(ParseStructTag("json"))` does not honour the `encoding/json` skip directive `json:"-"`. Fields tagged `json:"-"` are registered in the CEL type system under the literal name `"-"` and are readable from any user-submitted CEL expression via `dyn(obj)["-"]`. 

Additionally, `newNativeTypes` silently registers every nested struct reachable from the type passed to `NativeTypes`, including types from third-party dependencies the developer never examined.

## Root cause

In `fieldNameByTag`, the helper used by `ParseStructTag("json")` to translate Go struct tags into CEL field names.

See at `ext/native.go:146`:

```go
func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string {
    return func(field reflect.StructField) string {
        tag, found := field.Tag.Lookup(structTagToParse)
        if found {
            splits := strings.Split(tag, ",")
            if len(splits) > 0 {
                // We make the assumption that the leftmost entry in the tag is the name.
                // This seems to be true for most tags that have the concept of a name/key, such as:
                // https://pkg.go.dev/encoding/xml#Marshal
                // https://pkg.go.dev/encoding/json#Marshal
                // https://pkg.go.dev/go.mongodb.org/mongo-driver/bson#hdr-Structs
                // https://pkg.go.dev/go.yaml.in/yaml/v3#Marshal
                name := splits[0]
                return name
            }
        }

        return field.Name
    }
}
```

For a field tagged `json:"-"`, this code splits the tag into `[]string{"-"}` and returns `"-"` as the CEL field name. It never checks whether `"-"` is the JSON skip sentinel.

This contradicts the `encoding/json` rule that the source comment explicitly points readers to:

```text
As a special case, if the field tag is "-", the field is always omitted. Note
that a field with name "-" can still be generated using the tag "-,".
```

The public option also documents JSON-style parsing as the intended behavior.
See at `ext/native.go:190`:

```go
// ParseStructTag configures the struct tag to parse. The 0th item in the tag is used as the name of the CEL field.
// For example:
// If the tag to parse is "cel" and the struct field has tag cel:"foo", the CEL struct field will be "foo".
// If the tag to parse is "json" and the struct field has tag json:"foo,omitempty", the CEL struct field will be "foo".
func ParseStructTag(tag string) NativeTypesOption {
    return func(ntp *nativeTypeOptions) error {
        ntp.fieldNameHandler = fieldNameByTag(tag)
        return nil
    }
}
```

A developer using `ParseStructTag("json")` is therefore led to expect `encoding/json` field-name semantics. Instead, `json:"-"` is treated as a real field name.

The bad name is accepted during native type construction. `newNativeType` checks for duplicate field names, but it does not reject or skip empty names or skip sentinels.

See at `ext/native.go:663`:

```go
if fieldNameHandler != nil {
    fieldNames := make(map[string]struct{})

    for idx := 0; idx < refType.NumField(); idx++ {
        field := refType.Field(idx)
        fieldName := toFieldName(fieldNameHandler, field)

        if _, found := fieldNames[fieldName]; found {
            return nil, fmt.Errorf("invalid field name `%s` in struct `%s`: %w", fieldName, refType.Name(), errDuplicatedFieldName)
        } else {
            fieldNames[fieldName] = struct{}{}
        }
    }
}
```

Once accepted, the field becomes part of CEL's view of the type. Field enumeration reports it as a normal field name.

See at `ext/native.go:286`:

```go
func (tp *nativeTypeProvider) FindStructFieldNames(typeName string) ([]string, bool) {
    if t, found := tp.nativeTypes[typeName]; found {
        fieldCount := t.refType.NumField()
        fields := make([]string, fieldCount)
        for i := 0; i < fieldCount; i++ {
            fields[i] = toFieldName(tp.options.fieldNameHandler, t.refType.Field(i))
        }
        return fields, true
    }
    if celTypeFields, found := tp.baseProvider.FindStructFi...

GHSA-gcjh-h69q-9w9g

	0.14.5-6.9	0.16.1-26.1
Details
Registered	2 years ago	4 days ago
Digest	b356f9f	390438a
Version	0.14.5	0.16.1
Revision	6.9	26.1
Base image	SLE BCI-micro 15.5.24.1	SLE BCI-micro 15.7-61.11
Operating System	SLE 15.5	SLE 15.7
Architecture	x86_64	x86_64
Size	38.1 MB	52.7 MB
System Packages
bash	4.4-150400.25.22	4.4-150400.27.6.1
bash-sh	4.4-150400.25.22	4.4-150400.27.6.1
ca-certificates-mozilla-prebuilt	2.62-150200.30.1	2.84-150200.44.1
coreutils	8.32-150400.9.6.1	8.32-150400.9.12.1
glibc	2.31-150300.83.1	2.38-150600.14.58.1
gpg-pubkey	-	3fa1d6ce-67c856ee
libacl1	2.2.52-4.3.1	2.4.0-150000.4.6.1
libattr1	2.4.47-2.19	2.6.0-150000.4.3.1
libcap2	2.63-150400.3.3.1	2.63-150400.3.6.1
libgcc_s1	13.2.1+git8285-150000.1.9.1	15.3.0+git11272-150000.1.12.1
libncurses6	6.1-150000.5.24.1	6.1-150000.5.33.1
libpcre1	8.45-150000.20.13.1	Removed
libpcre2-8-0	-	10.42-150600.3.3.1
libreadline7	7.0-150400.25.22	7.0-150400.27.6.1
libselinux1	3.1-150400.1.69	3.5-150600.3.3.1
libstdc++6	13.2.1+git8285-150000.1.9.1	15.3.0+git11272-150000.1.12.1
metallb-speaker-0	0.14.5-150500.1.3	0.16.1-150700.5.4
skelcd-EULA-bci	2023.03.06-150500.2.1	20250430-150700.1.1
sles-release	15.5-150500.43.4	15.7-150700.67.6.1
terminfo-base	6.1-150000.5.24.1	6.1-150000.5.33.1
Vulnerabilities
CVE-2026-46600	Not present	Found Not affected
CVE-2026-56852	Not present	Found Not affected
CVE-2026-84304	Not present	Found
CVE-2026-84445	Not present	Found
GHSA-hrxh-6v49-42gf	Not present	Found
CVE-2026-84303	Not present	Found Not affected
GHSA-gcjh-h69q-9w9g	Not present	Found Not affected
CVE-2026-81870	Not present	Found
OCI Annotations
org.opencontainers.image.base.digest	sha256:934320b0d4c297307483eedcb05654ffba491973d518d08e8fc4c7399febcc91	sha256:52cd5d552529b8f05d86496cc7452e74d338a8542fff899a25617e783fa4bd6c
org.opencontainers.image.base.name	registry.suse.com/bci/bci-micro:15.5.24.1	registry.suse.com/bci/bci-micro:15.7-61.11

metallb-speaker

These are the differences found between the artifacts selected