SUSE-SU-2026:3203-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20263203-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3203-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3203-1
Upstream
CVE (21)
Related
CVE (21)
Published
2026-07-23T13:33:49Z
Modified
2026-07-24T17:15:09Z
Summary
Security update for kubevirt
Details

This update for kubevirt fixes the following issues:

  • Security: re-vendor the bundled Go dependencies (no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor):
    • golang.org/x/net v0.48.0 -> v0.55.0: CVE-2026-33814 (bsc#1265736), CVE-2026-39821 (bsc#1266575), CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 (bsc#1267120)
    • golang.org/x/crypto v0.46.0 -> v0.52.0: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 (bsc#1266151)
    • github.com/moby/spdystream v0.5.0 -> v0.5.1 folded into the vendor tree;
  • Build with Go >= 1.25 (required by golang.org/x/net 0.55).
References

Affected packages

SUSE:Linux Enterprise Module for Containers 15 SP7 / kubevirt

Package

Name
kubevirt
Purl
pkg:rpm/suse/kubevirt&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.4-150700.3.30.1

Ecosystem specific 

{
    "binaries":  [
        {
            "kubevirt-manifests":  "1.7.4-150700.3.30.1",
            "kubevirt-virtctl":  "1.7.4-150700.3.30.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3203-1.json"