SB2026090853 - SUSE update for terraform-provider-null
Published: September 8, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-84303)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization policies.
The vulnerability exists due to improper handling of case sensitivity in the xDS RBAC HTTP filter implementation when matching request headers against configured RBAC header rules. A remote attacker can send requests using mixed-case or canonical-case headers to bypass authorization policies.
Requests that should be rejected under DENY rules may instead be served because incoming metadata keys are lowercased before evaluation.
2) Resource exhaustion (CVE-ID: CVE-2026-84304)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the HTTP/2 DATA frame handling logic when processing highly fragmented gRPC stream payloads. A remote attacker can send a large number of tiny HTTP/2 DATA frames across one or more streams to cause a denial of service.
The issue can exhaust heap memory and trigger a runtime panic or out-of-memory condition even when the total payload remains within configured connection and stream flow-control windows.
Remediation
Install update from vendor's website.