Packages / openSUSE Tumbleweed / Source / Productivity/Clustering/Computing / warewulf4

Source Package: warewulf4 (4.7.0-4.1)

A suite of tools for clustering

The following binary packages are built from this source package:

warewulf4
A suite of tools for clustering
warewulf4-dracut
Dracut module for loading a Warewulf container image
warewulf4-man
Warewulf4 Man Pages
warewulf4-overlay
Default overlay for warewulf
warewulf4-overlay-rke2
Configuration template for RKE2
warewulf4-reference-doc
Warewulf4 Reference book

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-72815] Published: Aug 3, 2026, 4:54:21 PM UTC go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remot	Medium(6.9)	Affected Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.1-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Affected · Fixed: `4.7.1-1.1` nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.1-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.1-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.1-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.7.1-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed
[CVE-2026-56852] Published: Jul 14, 2026, 5:29:56 PM UTC A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.	High(7.5)	Unknown Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-4.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Fixed · Fixed: `4.7.0-4.1` nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-4.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-4.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-4.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.7.0-4.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed
[CVE-2026-33814] Published: May 7, 2026, 7:21:40 PM UTC When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.	High(7.5)	Unknown Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Fixed · Fixed: `4.7.0-1.1` nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.7.0-1.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed
[CVE-2026-34986] Published: Apr 3, 2026, 3:28:56 AM UTC Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token	High(7.5)	Unknown Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-2.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Fixed · Fixed: `4.7.0-2.1` nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-2.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-2.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.7.0-2.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.7.0-2.1` Version impact unknown nvd · warewulf4 · opensuse · tumbleweed
[CVE-2025-58058] Published: Aug 28, 2025, 9:54:05 PM UTC golang-github-ulikunitz-xz: CVE-2025-58058	Medium(5.3)	Unknown Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.4-1.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Fixed · Fixed: `4.6.4-1.1` dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.4-1.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.4-1.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.4-1.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.6.4-1.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed
[CVE-2025-22869] Published: Feb 26, 2025, 12:00:00 AM UTC Go Cryptography vulnerabilities	High(7.5)	Unknown Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.0-2.1` Version impact unknown usn · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Fixed · Fixed: `4.6.0-2.1` usn · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.0-2.1` Version impact unknown usn · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.0-2.1` Version impact unknown usn · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.0-2.1` Version impact unknown usn · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.6.0-2.1` Version impact unknown usn · warewulf4 · opensuse · tumbleweed
[CVE-2025-69725] Published: Jan 1, 2025, 12:00:00 AM UTC golang-github-go-chi-chi: CVE-2025-69725	Medium(6.1)	Unknown Details (6) `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.5-2.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Fixed · Fixed: `4.6.5-2.1` dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.5-2.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.5-2.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · noarch · tumbleweed Unknown · Fixed: `4.6.5-2.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed `4.7.0-4.1` · x86_64 · tumbleweed Unknown · Fixed: `4.6.5-2.1` Version impact unknown dsa · warewulf4 · opensuse · tumbleweed

Last synced: Oct 28, 2026, 1:40:02 AM UTC

[CVE catalog]

Sources

openSUSE Tumbleweed OSSSep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
tumbleweed-oss-multiarch:4db10cdde3ad82c7e22be35753c9e164b4bdd30f92db4aee17a0d4c94c5f902f
Repository-signature verification record
Signed object
https://download.opensuse.org/tumbleweed/repo/oss/repodata/repomd.xml
Signed-object SHA-256
4db10cdde3ad82c7e22be35753c9e164b4bdd30f92db4aee17a0d4c94c5f902f
Signer fingerprint
AD485664E901B867051AB15F35A2F86E29B700A4
Keyring revision
opensuse-project-signing-key.asc
SHA-256 b5745739ebfb95b25b8e810f9bcb847fe750ccda598bd85f02f0e974599a6d7e
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Result
Recorded as verified; digest details unavailable