{"id":"openSUSE-SU-2026:22027-1","summary":"Security update for golang-github-prometheus-alertmanager","details":"This update for golang-github-prometheus-alertmanager fixes the following issues:\n\nChanges in golang-github-prometheus-alertmanager:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.57.0 (bsc#1266615)\n\n- Update to version 0.33.1 (jsc#PED-16708):\n  * [BUGFIX] silences: fix silences snapshot missing legacy\n    matchers field. This caused a bug that prevented older\n    alertmanager versions from reading newer snapshots\n    unnecessarily.\n  * [BUGFIX] silence with no matchers should populate an empty\n    array in API response\n\n- Update to version 0.33.0:\n  * The '--enable-feature=auto-gomaxprocs' option has been\n    removed.\n  * Add a new Microsoft Teams integration that supports adaptive\n    cards.\n  * Add support for AWS Signature V4 to call AWS services that\n    require authentication.\n  * Add support for Google Chat as a notification channel.\n  * Add support for custom payloads in webhooks.\n\n- Update to version 0.32.2:\n  * [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup\n    swap.\n\n- Update to version 0.32.1:\n  * [BUGFIX] dispatcher: Fix issue with dispatching to a contended\n    route.\n\n- Update to version 0.32.0:\n  * Reduce memory allocations through pre-sizing collections and\n    batch allocation.\n  * CVE-2026-2303: Removed indirect dep on vulnerable mongodb\n                   driver (bsc#1269834)\n\n- Update to version 0.31.1:\n  * No user-visible changes\n\n- Update to version 0.31.0:\n  * Add full payload templating support for webhook notifier.\n  * Add support for UTF-8 label names in UI matchers.\n  * Fix escaping for matcher values with quotes in the UI.\n\n- Update to version 0.30.1:\n  * [BUGFIX] Fix memory leak in tracing client.\n\n- Update to version 0.30.0:\n  * Add Mattermost integration.\n  * Add support for Slack apps.\n  * Add distributed tracing support.\n  * Add names to inhibition rules.\n  * Add templating functions for working with URLs and JSON.\n  * Allow persistent peer names in a cluster.\n\n- Update to version 0.29.0:\n  * Add incident.io notifier.\n  * Add monospace message formatting.\n  * Update Jira notifier to support both Jira cloud API v3 and\n    Jira datacenter API v2.\n","modified":"2026-10-07T17:23:12.331472284Z","published":"2026-10-06T12:18:35Z","related":["CVE-2026-2303","CVE-2026-39821"],"upstream":["CVE-2026-2303","CVE-2026-39821"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266615"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269834"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-2303"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"}],"affected":[{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/golang-github-prometheus-alertmanager&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.33.1-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.33.1-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22027-1.json"}}],"schema_version":"1.9.0"}