Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Google OSConfig Agent: Unauthorized Access via HTTP/2 Header
published 5 months ago
Summary
A security update for the Google OSConfig Agent fixes two issues that could allow an attacker to bypass authorization and gain unauthorized access to the system. This affects systems using the Google OSConfig Agent, and it's recommended to apply the update to prevent potential security risks. Update your systems as soon as possible to ensure the latest security patches are in place.
Original advisory text
Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-
header (bsc#1260264).
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-
header (bsc#1260264).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-202621849-1/ Vendor Advisory
- https://bugzilla.suse.com/1236533 Third Party Advisory
- https://bugzilla.suse.com/1260264 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2023-45288 URL
- https://www.suse.com/security/cve/CVE-2026-33186 URL
Timeline
Published26 May 2026
Updated3 Jun 2026
First seen3 Jun 2026
Sources
SUSE-SU-2026:21849-1 · OSV
Track software like this
Free during beta