openSUSE-SU-2026:22027-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22027-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22027-1
Upstream
CVE (2)
Related
Published
2026-10-06T12:18:35Z
Modified
2026-10-07T17:23:12Z
Summary
Security update for golang-github-prometheus-alertmanager
Details

This update for golang-github-prometheus-alertmanager fixes the following issues:

Changes in golang-github-prometheus-alertmanager:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.57.0 (bsc#1266615)

  • Update to version 0.33.1 (jsc#PED-16708):

    • [BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily.
    • [BUGFIX] silence with no matchers should populate an empty array in API response
  • Update to version 0.33.0:

    • The '--enable-feature=auto-gomaxprocs' option has been removed.
    • Add a new Microsoft Teams integration that supports adaptive cards.
    • Add support for AWS Signature V4 to call AWS services that require authentication.
    • Add support for Google Chat as a notification channel.
    • Add support for custom payloads in webhooks.
  • Update to version 0.32.2:

    • [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap.
  • Update to version 0.32.1:

    • [BUGFIX] dispatcher: Fix issue with dispatching to a contended route.
  • Update to version 0.32.0:

    • Reduce memory allocations through pre-sizing collections and batch allocation.
    • CVE-2026-2303: Removed indirect dep on vulnerable mongodb driver (bsc#1269834)
  • Update to version 0.31.1:

    • No user-visible changes
  • Update to version 0.31.0:

    • Add full payload templating support for webhook notifier.
    • Add support for UTF-8 label names in UI matchers.
    • Fix escaping for matcher values with quotes in the UI.
  • Update to version 0.30.1:

    • [BUGFIX] Fix memory leak in tracing client.
  • Update to version 0.30.0:

    • Add Mattermost integration.
    • Add support for Slack apps.
    • Add distributed tracing support.
    • Add names to inhibition rules.
    • Add templating functions for working with URLs and JSON.
    • Allow persistent peer names in a cluster.
  • Update to version 0.29.0:

    • Add incident.io notifier.
    • Add monospace message formatting.
    • Update Jira notifier to support both Jira cloud API v3 and Jira datacenter API v2.
References

Affected packages

openSUSE:Leap 16.0 / golang-github-prometheus-alertmanager

Package

Name
golang-github-prometheus-alertmanager
Purl
pkg:rpm/opensuse/golang-github-prometheus-alertmanager&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.33.1-bp160.1.1

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-alertmanager": "0.33.1-bp160.1.1"
        }
    ]
}

Database specific

source
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22027-1.json"