openSUSE-SU-2026:22116-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22116-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22116-1
Upstream
CVE (2)
Related
CVE (2)
Published
2026-10-14T07:40:11Z
Modified
2026-10-19T17:23:14Z
Summary
Security update for hauler
Details

This update for hauler fixes the following issues:

Changes in hauler:

  • update to 2.1.1:

    • bumped go version to v1.26.7 (backport #771)
    • https registry auth fix (backport #763)
    • adjust supporting artifact retrieval (backport #777)
    • reject --platform on digest-pinned multi-platform images
    • fix: serve registry returns an empty /v2/_catalog list
    • added airgapped support for install.sh and added windows install.ps1
    • added/fixed basic auth with registry and fileserver
    • fixed store inventory race with concurrent processes
    • added type filter to store copy
    • fixed missing dirs in containers
    • updated github workflows with versions, permissions, and concurrency

  • update vendor.tar to fix:

    • bsc#1280110, CVE-2026-53495
References

Affected packages

openSUSE:Leap 16.0 / hauler

Package

Name
hauler
Purl
pkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.1.1-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "hauler":  "2.1.1-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22116-1.json"