Back Linuxsecurity

SUSE google-osconfig-agent Moderate Input Issue CVE-2026-56852 2026-3496

Linuxsecurity •LinuxSecurity Advisories • August 5, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

## This update for google-osconfig-agent fixes the following issue: * CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop (bsc#1272118). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Public Cloud Module 12 zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2026-3496=1 ## Package List: * Public Cloud Module 12 (aarch64 ppc64le s390x x86_64) * google-osconfig-agent-20260615.01-1.53.2

* CVE-2026-56852 ( SUSE ): 6.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-56852 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-56852 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* Public Cloud Module 12

* SUSE Linux Enterprise High Performance Computing 12 SP2

* SUSE Linux Enterprise High Performance Computing 12 SP3

* SUSE Linux Enterprise High Performance Computing 12 SP4

* SUSE Linux Enterprise High Performance Computing 12 SP5

* SUSE Linux Enterprise Server 12

* SUSE Linux Enterprise Server 12 SP1

* SUSE Linux Enterprise Server 12 SP2

* SUSE Linux Enterprise Server 12 SP3

* SUSE Linux Enterprise Server 12 SP4

* SUSE Linux Enterprise Server 12 SP5

Announcement ID: SUSE-SU-2026:3496-1 Release Date: 2026-08-04T16:18:02Z Rating: moderate

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Patches Moderate Vulnerability in google-guest-agent and google-osconfig-agent SUSE has released updates for two components, google-guest-agent and google-osconfig-agent, addressing a moderate vulnerability identified as CVE-2026-56852. This vulnerability involves improper handling of input containing invalid UTF-8 bytes, which can lead to an infinite loop. Affected systems include various versions of SUSE Linux Enterprise Server and Public Cloud Modules. The vulnerability was published on July 21, 2026, and is rated moderate in severity. Administrators are advised to apply the patches using SUSE's recommended methods. The updates were released on August 4, 2026, with specific commands provided for installation. The vulnerability affects multiple architectures, including x86_64 and aarch64. No active exploitation has been reported at this time. 8 sources 46

Extracted Entities

CVEs (1)

CVE-2026-56852

Domains (1)

golang.org