Description of the patch:
This update for terraform-provider-susepubliccloud fixes the following issues
- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2
:path
pseudo-header (bsc#1260180).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266477).
- CVE-2026-41602: github.com/apache/thrift:
TFramedTransport frame size headers can lead to a uint32 integer
overflow (bsc#1263515).
- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in
TSSLTransportFactory can lead to host
mismatch (bsc#1263606).
- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read
and application crash (bsc#1263445).
- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer
overflow (bsc#1263411).
- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in
c_glib dispatch can lead to uncontrolled
recursion and denial of service (bsc#1263357).
- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds
read and potential information disclosure (bsc#1263316).
- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via
stack exhaustion (bsc#1263247).