{"schema_version":"1.7.5","id":"openSUSE-SU-2026:20893-1","published":"2026-06-02T17:46:55Z","modified":"2026-06-04T09:00:05.940129575Z","related":["CVE-2024-45337","CVE-2025-22869","CVE-2025-58181","CVE-2026-33814","CVE-2026-39821"],"upstream":["CVE-2024-45337","CVE-2025-22869","CVE-2025-58181","CVE-2026-33814","CVE-2026-39821"],"summary":"Security update for cloudflared","details":"This update for cloudflared fixes the following issues:\n\nChanges in cloudflared:\n\n- Update version to 2026.5.2\n  * Add more information to proxy-dns removal message\n  * Update tail command to use /management/logs endpoint\n  * Add cloudflared management token command\n  * Fix bugs\n  * Update golang.org/x/net to 0.55.0 (boo#1266794, boo#1265920, CVE-2026-39821\n    CVE-2026-33814)\n\n- Update version to 2026.2.0\n  * Fix bugs\n\n- Update version to 2025.11.1\n  * bump coredns to solve CVE\n  * add vulncheck to cloudflared\n  * Remove references to cloudflare-go\n  * Add logging format as JSON\n  * Centralize UDP origin proxy dialing as ingress service\n  * Add virtual DNS service\n  * Add OriginDialerService to include TCP\n  * Add --dns-resolver-addrs flag\n  * Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences\n  * Bump go-boring from 1.24.2 to 1.24.4\n  * Add metrics for virtual DNS origin\n  * set proper url and hostname for cloudflared tail command\n  * Add support for login interstitial auto closure\n  * update fed callback url for login helper\n  * Correct QUIC connection management for datagram handlers\n  * Set endpoint in tunnel credentials when generating locally managed tunnel\n    with a Fed token\n  * Migrate cloudflared-ci pipelines to Gitlab CI\n  * Add support for FedRAMP in originRequest Access config\n  * Add buffers for UDP and ICMP datagrams in datagram v3\n  * Add write deadline for UDP origin writes\n  * Improve metrics for datagram v3\n  * Force usage of go-boring 1.24\n  * Fix import of GPG keys when two keys are provided\n  * Fix parameter order when uploading RPM .repo file to R2\n  * Add new datagram v3 feature flag\n  * Bump datagram v3 write channel capacity\n  * Fix upload of RPM repo file during double signing\n  * Fix the cloudflared binary path used in the component test\n  * Fix typo causing r2-release-next deployment to fail\n  * Update from go1.24.6 to go1.24.9\n  * Fix systemd service installation hanging\n  * Add cf-proxy-* to control response headers\n  * Add pipelines for linux packaging\n  * Prefix gitlab steps with operating system\n  * Fix docker hub push step\n  * Fix CVE-2025-58181 boo#1253918\n  * Fix CVE-2025-22869 boo#1239422\n\n- Update version to 2025.6.0\n  * Remove dynamic reloading of features for datagram v3\n  * Add metric for unsupported RPC commands for datagram v3\n  * Add dynamic loading of features to connections via ConnectionOptionsSnapshot\n  * Use is_default_network instead of is_default to create vnet's\n  * Update go to 1.24\n\n- Update version to 2025.4.2\n  * emit explicit errors for the service command on unsupported OSes\n  * Fix some issues\n\n- Update version to 2024.12.1\n  * TUN-8748: Migrated datagram V3 flows to use migrated context\n  * TUN-8737: update metrics server port selection\n  * TUN-8731: Implement diag/system endpoint\n  * TUN-8728: implement diag/tunnel endpoint\n  * TUN-8730: implement diag/configuration\n  * TUN-8735: add managed/local log collection\n  * TUN-8733: add log collection for docker\n  * TUN-8734: add log collection for kubernetes\n  * TUN-8640: Refactor ICMPRouter to support new ICMPResponders\n  * TUN-8729: implement network collection for diagnostic procedure\n  * TUN-8727: implement metrics, runtime, system, and tunnelstate in diagnostic\n    http client\n  * TUN-8726: implement compression routine to be used in diagnostic procedure\n  * TUN-8732: implement port selection algorithm\n  * TUN-8762: fix argument order when invoking tracert and modify network info\n    output parsing\n  * TUN-8769: fix k8s log collector arguments\n  * TUN-8727: extend client to include function to get cli configuration\n    and tunnel configuration\n  * TUN-8725: implement diagnostic procedure\n  * TUN-8767: include raw output from network collector in diagnostic zip file\n  * TUN-8770: add cli configuration and tunnel configuration to diagnostic zipfile\n  * TUN-8768: add job report to diagnostic zipfile\n  * TUN-8775: Make sure the session Close can only be called once\n  * TUN-8781: Add Trixie, drop Buster. Default to Bookworm\n  * TUN-8640: Add ICMP support for datagram V3\n  * TUN-8789: make python package installation consistent\n  * TUN-8795: update createrepo to createrepo_c to fix the release_pkgs.py\n    script\n- fix CVE-2024-45337 and boo#1234582\n\n- Update version to 2024.11.1\n  * Add cloudflared tunnel health command\n  * PPIP-2310: Update quick tunnel disclaimer\n  * TUN-8621: Prevent QUIC connection from closing before grace period\n    after unregistering\n  * TUN-8484: Print response when QuickTunnel can't be unmarshalled\n  * TUN-8592: Use metadata from the edge to determine if request body is\n    empty for QUIC transport\n  * TUN-8621: Fix cloudflared version in change notes to account for\n    release date\n  * TUN-8638: Add datagram v3 serializers and deserializers\n  * TUN-8685: Bump coredns dependency\n  * TUN-8688: Correct UDP bind for IPv6 edge connectivity on macOS\n  * TUN-8694: Fix github release script\n  * TUN-8694: Rework release script\n  * TUN-8661: Refactor connection methods to support future different\n    datagram muxing methods\n  * TUN-8692: remove dashes from session id\n  * TUN-8708: Bump python min version to 3.10\n  * TUN-8667: Add datagram v3 session manager\n  * TUN-8553: Bump go to 1.22.5 and go-boring 1.22.5-1\n  * TUN-8700: Add datagram v3 muxer\n  * TUN-8646: Allow experimental feature support for datagram v3\n  * TUN-8641: Expose methods to simplify V3 Datagram parsing on the edge\n  * VULN-66059: remove ssh server tests\n  * TUN-8709: Add session migration for datagram v3\n  * TUN-8701: Add metrics and adjust logs for datagram v3\n  * add: new go-fuzz targets\n  * TUN-8701: Simplify flow registration logs for datagram v3\n","references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1234582"},{"type":"REPORT","url":"https://bugzilla.suse.com/1239422"},{"type":"REPORT","url":"https://bugzilla.suse.com/1253918"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265920"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266794"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-45337"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22869"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58181"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33814"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"}]}