Skip to content
High-Risk Vulnerabilities in aliyun-cli Affect Multiple SUSE Systems

High-Risk Vulnerabilities in aliyun-cli Affect Multiple SUSE Systems

First seen 12 Nov 2026, 06:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 06:19 UTC
  • •CVE-2026-116591 is actively exploited, allowing denial of service via crafted zstd frames.
  • •CVE-2026-63209 involves a signed integer overflow that can crash processes.
  • •Users of SUSE Linux Enterprise and openSUSE Leap should update to version 3.5.2 immediately.

Recent updates to the aliyun-cli tool address two significant vulnerabilities: CVE-2026-116591 and CVE-2026-63209. CVE-2026-116591, published on October 26, 2026, allows crafted zstd frames to cause a panic in the decoder, impacting systems using the affected library. CVE-2026-63209, published on September 29, 2026, involves a signed integer overflow that can lead to process crashes. Both vulnerabilities have been assigned high CVSS scores of 8.7 and 7.5, respectively. The updates are crucial for users of SUSE Linux Enterprise Server and openSUSE Leap, as they mitigate potential exploitation risks. While CVE-2026-116591 is confirmed to be, CVE-2026-63209 does not have confirmed exploitation reports. Users are urged to update to version 3.5.2 of aliyun-cli to ensure protection against these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2026-09-29
CVE-2026-63209 published
A signed integer overflow vulnerability in aliyun-cli was disclosed, allowing process crashes.
Linuxsecurity
2026-10-26
CVE-2026-116591 published
A crafted zstd frame vulnerability was disclosed, causing panic in the decoder.
Linuxsecurity
2026-11-04
Patch released for CVE-2026-116591
An important update was issued for aliyun-cli to fix CVE-2026-116591, with users advised to upgrade.
Linuxsecurity
2026-11-11
Patch released for CVE-2026-63209
SUSE released an update for aliyun-cli addressing CVE-2026-63209, urging users to upgrade.
Linuxsecurity

More articles in this cluster (3)

Following this threat?

Track SuSE and CVE-2026-116591 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which versions of aliyun-cli are affected?
Versions of aliyun-cli prior to 3.5.2 are affected by CVE-2026-116591 and CVE-2026-63209.
How urgent is the patching process?
Patching is urgent, especially for CVE-2026-116591, which is actively exploited in the wild.
What steps should I take to mitigate these vulnerabilities?
Immediately update to version 3.5.2 of aliyun-cli to protect against both vulnerabilities.