SUSE Kubevirt Important Update Fixing Privilege Escalation Vulnerabilities

Back Linuxsecurity

SUSE Kubevirt Important Update Fixing Privilege Escalation Vulnerabilities

Linuxsecurity •LinuxSecurity Advisories • June 16, 2026

Share: View original

## This update for kubevirt fixes the following issues: Update to version 1.7.4, fixes various go embedded security issues: * CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251420). * CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253559). * CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254014). * CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253935). * CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by

## This update for kubevirt fixes the following issues: Update to version 1.7.4, fixes various go embedded security issues: * CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251420). * CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253559). * CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254014). * CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253935). * CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by

* CVE-2025-47911 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-47911 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-47911 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-47913 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-47913 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Announcement ID: SUSE-SU-2026:2400-1 Release Date: 2026-06-15T15:34:14Z Rating: critical

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Auth Bypass Vulnerability in SUSE Elemental Systems (CVE-2026-33186) A significant authorization bypass vulnerability (CVE-2026-33186) has been identified in multiple SUSE Elemental systems, including the elemental-system-agent, elemental-toolkit, and elemental-register. This flaw arises from improper validation of the HTTP/2 path pseudo-header, allowing unauthorized access. The vulnerability was published on March 20, 2026, and a proof of concept was released on April 7, 2026. Affected systems include SUSE Linux Micro 6.2 and openSUSE Leap 16.0. Updates have been released to address this issue, with critical CVSS scores indicating a high level of risk. Security professionals are urged to apply the patches immediately to mitigate potential exploitation. The updates were made available on June 8, 2026, with multiple advisories confirming the vulnerability's impact across various components. 75 sources 74

Extracted Entities

Companies (1)

CVEs (5)

CVE-2025-47911 CVE-2025-47913 CVE-2025-47914 CVE-2025-58181 CVE-2025-58190

CWE Weaknesses (2)

CWE-125 - Out-of-bounds Read CWE-400 - Uncontrolled Resource Consumption

Domains (1)

Platforms (1)