SB2026111299 - SUSE update for amazon-cloudwatch-agent
Published: November 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-84303)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization policies.
The vulnerability exists due to improper handling of case sensitivity in the xDS RBAC HTTP filter implementation when matching request headers against configured RBAC header rules. A remote attacker can send requests using mixed-case or canonical-case headers to bypass authorization policies.
Requests that should be rejected under DENY rules may instead be served because incoming metadata keys are lowercased before evaluation.
2) Resource exhaustion (CVE-ID: CVE-2026-84304)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the HTTP/2 DATA frame handling logic when processing highly fragmented gRPC stream payloads. A remote attacker can send a large number of tiny HTTP/2 DATA frames across one or more streams to cause a denial of service.
The issue can exhaust heap memory and trigger a runtime panic or out-of-memory condition even when the total payload remains within configured connection and stream flow-control windows.
3) Improper Validation of Array Index (CVE-ID: CVE-2026-84445)
CWE-ID: CWE-129 - Improper Validation of Array Index
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by terminating the gRPC-Go server process.
The vulnerability exists due to improper array index validation in the xDS routing interceptor installed by xds.NewGRPCServer() when accessing the first element of an empty authorities slice, triggering an unrecovered panic. A remote attacker can send a request missing both :authority and Host headers after establishing an HTTP/2 transport connection, requiring valid transport credentials if mTLS or ALTS is enforced, to crash the server.
Remediation
Install update from vendor's website.