SUSE SLES15 Security Update : distribution (SUSE-SU-2026:5202-1)

high Nessus Plugin ID 379480

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5202-1 advisory.

- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276677).
- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283762).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285297).
- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker- driven log emission (bsc#1281469).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279316).
- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279219).
- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278997).

Changes for distribution:

- Update to version 3.1.2:
* build(deps): bump actions/setup-go from 6.4.0 to 7.0.0
* build(deps): bump the docker-actions group across 1 directory with 3 updates
* chore(release): prepare for v3.1.2 release
* build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1
* build(deps): bump the codeql-actions group with 4 updates
* ci: dependabot: group CodeQL and Docker action updates
* registry: remove logrus-logstash-hook dependency
* chore(docs): fix build status badge
* build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0
* chore(deps): bump oltp version
* chore(ci): bump alpine image version
* fix(deps): update deps to fix security vulns
* docs: explain Redis Sentinel configuration
* Fix lint
* fix(deps): bump grpc dep to fix sec vuln
* fix(handlers): defer context cancellation on Shutdown to stop upload purger
* chore(build): Bump go version to latest 1.26
* fix(s3): use path.Dir instead of filepath.Dir in directoryDiff
* fix(ci): fix broken minio image
* docs: fix 'allows to rewrite' grammar in rewrite storage middleware
* Fix 500s from malformed manifest digests and out-of-order final chunk PUTs
* test: use ephemeral ports for registry listen tests
* configuration: migrate to go.yaml.in/yaml/v2
* chore(deps): github.com/sirupsen/logrus v1.10.2
* chore(deps): github.com/stretchr/testify v1.12.1
* chore(deps): github.com/docker/go-metrics v0.1.0
* docs: fix CloudFront Origin Path guidance for S3 driver
* fix(tags): return empty array after final pagination marker
* build(deps): bump google.golang.org/grpc
* fix(client): verify blob content against requested digest in Get
* fix(client): verify manifest content against requested digest
* rename errcodeErrorsFor -> toErrcodeErrors
* pass thru upstream error code
* docs: document catalog.maxentries configuration
* fix(storage): don't drop catalog repos that prefix another name
* fix contentRangeRegexp to accept unknown total size
* fix(s3): tags/list drops tags that are a lexical prefix of another tag
* fix: check backend directly in blobStore.Put to avoid stale cache
* azure: fix race condition in PutContent causing duplicate append writes
* fix(s3): add redirectendpoint validation and fix doc formatting
* build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0
* build(deps): bump github/codeql-action from 4.35.5 to 4.36.0
* build(deps): bump docker/login-action from 4.1.0 to 4.2.0
* build(deps): bump docker/bake-action from 7.1.0 to 7.2.0
* build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1
* chore: smol go fix changes
* build(deps): bump github/codeql-action from 4.35.4 to 4.35.5
* Fix blob type migration in the azure driver
* build(deps): bump github/codeql-action from 4.35.3 to 4.35.4
* build(deps): bump actions/labeler from 6.0.1 to 6.1.0
* build(deps): bump github/codeql-action from 4.35.2 to 4.35.3
* build(deps): bump github/codeql-action from 4.35.1 to 4.35.2
* build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
* fix: report error in `DeleteManifest` when `Delete` returns `ErrDigestUnsupported`

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected distribution-registry package.

Plugin Details

Severity: High

ID: 379480

File Name: suse_SU-2026-5202-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.58

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-37236

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-84445

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:distribution-registry

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/11/2026

Vulnerability Publication Date: 5/28/2026

Reference Information

CVE: CVE-2026-37236, CVE-2026-41178, CVE-2026-63209, CVE-2026-78669, CVE-2026-81871, CVE-2026-81872, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445

SuSE: SUSE-SU-2026:5202-1

Detections

Analytics