SUSE-SU-2026:23162-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202623162-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23162-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:23162-1
Upstream
CVE (3)
Related
CVE (3)
Published
2026-08-04T11:10:41Z
Modified
2026-08-22T18:23:33Z
Summary
Security update for helm
Details

This update for helm fixes the following issues:

Update to version 3.21.3.

  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
  • CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: missing validation in auth.Client() allows a malicious registry to hijack Bearer token realms to exfiltrate credentials and refresh tokens (bsc#1270127).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing truncated/invalid UTF-8 input can lead to infinite loop (bsc#1271997).

Changes for helm:

  • Update x/text to 0.40.0.
  • Update x/net to 0.57.0.
  • Update to version 3.21.3:
    • Apply suggestions from code review 1ad6e68 (Benoit Tigeot).
    • fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e (Benoit Tigeot).
    • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178b (dependabot[bot]).
References

Affected packages

SUSE:Linux Micro 6.1 / helm

Package

Name
helm
Purl
pkg:rpm/suse/helm&distro=SUSE%20Linux%20Micro%206.1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.21.3-slfo.1.1_1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "helm":  "3.21.3-slfo.1.1_1.1",
            "helm-bash-completion":  "3.21.3-slfo.1.1_1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23162-1.json"