Detections
Analytics

SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:5203-1)

high Nessus Plugin ID 379430

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5203-1 advisory.

 Security issues fixed:

 - CVE-2026-14362: HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue (bsc#1271206).
 - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283592).
 - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281472).
 - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker- driven log emission (bsc#1281473).
 - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279331).
 - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279232).
 - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS servers (bsc#1279394).

 Non security issue fixed:

 - alloy 1.20.1: alloy.service references missing /usr/lib/alloy/alloy-wrapper (203/EXEC) (bsc#1285585).

 Changes for alloy:

 - Increase required memory in constraints
 - Update to version 1.20.1:
 * Bug fixes:
 loki: Add the timestamp to batch size calculation loki: Include estimate for stream labels in batch size loki: Make byte counters count uncompressed bytes otelcol.connector.host_info: Fix potential over-count otelcol.receiver.cloudflare: Default max_request_body_size to 20MiB prometheus.remote_write: Tolerate unknown WAL record types
 - Update to version 1.20.0:
 * BREAKING CHANGE: discovery.hetzner: no longer exports the
 __meta_hetzner_datacenter label for targets with role = 'hcloud'
 * BREAKING CHANGE: otelcol.receiver.filelog: top_n now distinguishes an explicit 0 from leaving it unset
 * Features:
 loki.source.podlogs: Add use_apiserver_cache to reduce API server load loki.write: Add max_streams to limit active streams pyroscope.scrape: Support scraping custom pprof profiles
 * Enhancements:
 discovery.kubernetes: Add support for EndpointSlice filtering by service loki.process: stage.geoip now supports GeoLite2 City database discovery.file: Fix targets not updating on content change prometheus.relabel: Fix metrics getting stuck in NaN state

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected alloy package.

See Also

https://bugzilla.suse.com/1271206

https://bugzilla.suse.com/1279232

https://bugzilla.suse.com/1279331

https://bugzilla.suse.com/1279394

https://bugzilla.suse.com/1281472

https://bugzilla.suse.com/1281473

https://bugzilla.suse.com/1283592

https://bugzilla.suse.com/1285585

https://www.suse.com/security/cve/CVE-2026-14362

https://www.suse.com/security/cve/CVE-2026-63209

https://www.suse.com/security/cve/CVE-2026-81871

https://www.suse.com/security/cve/CVE-2026-81872

https://www.suse.com/security/cve/CVE-2026-84303

https://www.suse.com/security/cve/CVE-2026-84304

https://www.suse.com/security/cve/CVE-2026-84445

http://www.nessus.org/u?4c245ac8

Plugin Details

Severity: High

ID: 379430

File Name: suse_SU-2026-5203-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.39

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-84303

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-63209

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-84445

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:alloy

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/11/2026

Vulnerability Publication Date: 7/8/2026

Reference Information

CVE: CVE-2026-14362, CVE-2026-63209, CVE-2026-81871, CVE-2026-81872, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445

SuSE: SUSE-SU-2026:5203-1