Back Linuxsecurity

SUSE Libzypp Zypper Critical Update Security Fixes SUSE-SU-2026-4112

Linuxsecurity •LinuxSecurity Advisories • September 10, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for libzypp, zypper fixes the following issues: Security issue fixed: * invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY- CACHE-01] (bsc#1274625). * hasCredentials() requires both username AND password to be non-empty (bsc#1273242). * GPG Key hints in repoindex.xml require at least a long id to allow auto- import (bsc#1271730). Non security issues fixed: * Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534). * libzypp: X-ZYpp-AnonymousId header anomaly (bsc#1268321). * Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249). * zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).

* SUSE Linux Enterprise Desktop 15 SP6

* SUSE Linux Enterprise High Performance Computing 15 SP6

* SUSE Linux Enterprise Server 15 SP6

* SUSE Linux Enterprise Server 15 SP6 LTSS

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that has nine security fixes can now be installed.

Announcement ID: SUSE-SU-2026:4112-1 Release Date: 2026-09-09T16:17:44Z Rating: critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Security Fix for openSUSE and SUSE libzypp zypper Vulnerabilities On September 9, 2026, SUSE released a critical security update (SUSE-SU-2026-4112) for libzypp and zypper, addressing multiple vulnerabilities affecting various SUSE Linux distributions, including openSUSE 15.6 and SUSE Linux Enterprise 15 SP6. The vulnerabilities include issues with the legacy unsigned-repository cache state, credential handling, and GPG key hints, which could potentially allow unauthorized access or manipulation of repository data. The update fixes three critical security issues and several non-security bugs. Affected systems include SUSE Linux Enterprise Server, Desktop, and High-Performance Computing editions. Users are urged to apply the patches immediately to mitigate risks. The vulnerabilities were reported under various bug tracking IDs, including bsc#1274625 and bsc#1271730. The patches can be installed using standard SUSE installation methods such as YaST or zypper commands. The update is critical, and users should prioritize applying it to ensure system security. 7 sources 72

Extracted Entities

Platforms (5)

SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server 15 SP6 LTSS SUSE Linux Enterprise Server For SAP Applications 15 SP6