## This update for alloy fixes the following issues: * CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of- Bounds Read in GSSAPI Error Handling (bsc#1269861). * CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method- Override header and bypass established access control (bsc#1277996). * CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276742). * CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can lead to exfiltration of sensitive data (bsc#1267482). * CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics

* bsc#1267482

* bsc#1267483

* bsc#1267484

* bsc#1267486

* bsc#1267487

* bsc#1268982

* bsc#1269861

* bsc#1272028

* bsc#1272418

* bsc#1276742

* bsc#1276982

* bsc#1276992

* bsc#1277429

* bsc#1277996

* bsc#1278671

* bsc#1278693

* bsc#1280671

Cross-

* CVE-2026-2303

* CVE-2026-37236

* CVE-2026-41178

* CVE-2026-45679

* CVE-2026-45680

* CVE-2026-45681

* CVE-2026-45683

* CVE-2026-45684

* CVE-2026-46600

* CVE-2026-48496

* CVE-2026-56852

* CVE-2026-56854

* CVE-2026-56855

* CVE-2026-71556

* CVE-2026-71557

* CVE-2026-75889

* CVE-2026-78662

* CVE-2026-81521

* CVE-2026-89090

CVSS scores:

* CVE-2026-2303 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

* CVE-2026-2303 ( NVD ): 6.9