{"id":"SUSE-SU-2026:4554-1","summary":"Security update for google-osconfig-agent","details":"This update for google-osconfig-agent fixes the following issue:\n\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283672).\n\nChanges for google-osconfig-agent:\n\nUpdate to version 20260928.01\n  \n * scalibr linux new metadata support (#1038)\n * Fix failing to report REBOOTING state during postPatchReboot\n due to context canceled for Windows VMs (#1055)\n * Fix os/snap extractor usage (#1053)\n- Update github.com/klauspost/compress to v1.18.7\n (bsc#1283672, CVE-2026-63209)\n * bump grpc package to new version (#1057)\n * bump some dependencies across few modules (#1056)\n- Update github.com/klauspost/compress to v1.18.7\n (bsc#1283672, CVE-2026-63209)\n","modified":"2026-10-07T16:45:04.045104621Z","published":"2026-10-07T08:00:37Z","related":["CVE-2026-63209"],"upstream":["CVE-2026-63209"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264554-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283672"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63209"}],"affected":[{"package":{"name":"google-osconfig-agent","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","purl":"pkg:rpm/suse/google-osconfig-agent&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260928.01-1.63.1"}]}],"ecosystem_specific":{"binaries":[{"google-osconfig-agent":"20260928.01-1.63.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4554-1.json"}}],"schema_version":"1.9.0"}