← Search the atlas
SUSE-SU-2026:2823-1
Not scored
Security update for helm
This update for helm fixes the following issues
- Update to version 3.21.2
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
Exploit probability
Not scored
Published
July 9, 2026
Required by
Not available
Last source change
July 10, 2026
02 / AFFECTED SOFTWARE
Affected packages
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
helm
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
helm
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
helm
SUSE:Linux Enterprise Micro 5.5
helm
SUSE:Linux Enterprise Module for Containers 15 SP7
helm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
helm
SUSE:Linux Enterprise Server 15 SP4-LTSS
helm
SUSE:Linux Enterprise Server 15 SP5-LTSS
helm
SUSE:Linux Enterprise Server 15 SP6-LTSS
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
helm
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
helm
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
SUSE-SU-2026:2823-1
This update for helm fixes the following issues
- Update to version 3.21.2
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598).
- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
View original source ↗
05 / REFERENCES
Further evidence