Security updates¶
This page lists the fixed CVEs for this release.
List of fixed CVEs¶
The following table lists the Common Vulnerabilities and Exposures (CVE) fixes included in this release.
| CVE number | Bug IDs | Image names | Package name |
|---|---|---|---|
| CVE-2025-45582 | 2446633 | baseos | tar |
| CVE-2025-69720 | 2446693 | baseos | libncursesw6 |
| CVE-2026-39822 | 2446629 | baseos | stdlib |
| CVE-2026-41991 | 2446649 | baseos | gzip |
| CVE-2026-41992 | 2446653 | baseos | gzip |
| CVE-2026-42505 | 2446657 | baseos | stdlib |
| CVE-2026-48978 | 2445969 | system-manager | oras.land/oras-go/v2 |
| CVE-2026-50151 | 2445949 | system-manager | oras.land/oras-go/v2 |
| CVE-2026-50162 | 2445961 | system-manager | oras.land/oras-go/v2 |
| CVE-2026-56852 | 2445909, 2445921, 2445977, 2445993, 2446033 | otel-collector, otel-config-builder, provisioning, system-manager, zitadel-bootstrap | golang.org/x/text |
| CVE-2026-5704 | 2446677 | baseos | tar |
| GHSA-JPCW-4WR7-C3VQ | 2446025, 2446429 | backend, provisioning | github.com/getkin/kin-openapi |
| GHSA-R277-6W6Q-XMQW | 2446021, 2446389 | backend, provisioning | github.com/getkin/kin-openapi |
| GHSA-VH4V-2XQ2-G5CG | 2445965 | system-manager | oras.land/oras-go/v2 |