openSUSE Patches New zstd Crash Flaw in cadvisor for Leap 16 Container Monitoring
openSUSE has released a security update for the cadvisor container metrics agent on openSUSE Leap 16.0, an advisory SUSE rates as important. The update resolves two vulnerabilities and includes two bug fixes, the more serious being CVE-2026-116591, rated 7.5 under CVSS 3.1 and 8.7 under CVSS 4.0 by SUSE, which sits in the bundled github.com/klauspost/compress/zstd decompression library. It is accompanied by CVE-2026-78663, a lower severity issue scored 5.3 in the golang.org/x/net/http2 package. SUSE records the fixes against bug references bsc#1288588 and bsc#1288212. Fixed packages for Leap 16.0 are published as cadvisor-0.60.6-bp160.4.1.
Both weaknesses are supply chain issues inherited through vendored Go dependencies rather than defects in cadvisor's own code. A crafted two-block zstd frame of roughly 27 KB causes both the DecodeAll function and the streaming decoder to panic, terminating the process that handles the input. The second issue is a double flow control refund on HTTP/2 server streams, which can disturb the connection accounting that limits how much data a client may send. No worked exploitation chain has been published for either flaw, and both carry availability-only impact in their CVSS vectors.
cadvisor runs alongside container runtimes and exposes metrics endpoints to monitoring stacks, so a remotely triggered panic means lost container observability rather than compromise of workloads. The zstd flaw matters more because decompression routines routinely process untrusted input. FIRST EPSS places exploitation probability over the next thirty days at 0.3 percent for CVE-2026-116591 and 0.6 percent for CVE-2026-78663. Neither shows any evidence of exploitation in the wild.
Attack Surface
Infrastructure, Supply Chain (Third-party vendors), Server OS
Tactics
Impact, Initial Access
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
- T1195.001 – Compromise Software Dependencies and Development Tools
SuperPRO's Threat Countermeasures Procedures
- Apply the new patch on openSUSE Leap 16.0 with 'zypper in -t patch openSUSE-Leap-16.0-packagehub-719=1' and confirm with 'rpm -q cadvisor' that the installed build is cadvisor-0.60.6-bp160.4.1 or later, which carries the refreshed vendor.tar.
- Confirm the openSUSE PackageHub repository for Leap 16.0 is enabled with 'zypper lr -u', since the fixed cadvisor build is delivered through the openSUSE-Leap-16.0-packagehub-719 patch rather than the base repositories.
- Verify fix coverage with 'zypper patch-info openSUSE-Leap-16.0-packagehub-719', which lists CVE-2026-116591 and CVE-2026-78663 as resolved by the cadvisor-0.60.6-bp160.4.1 update.
- Restart the cadvisor service after installing cadvisor-0.60.6-bp160.4.1 so the running process no longer executes the previously vendored zstd and golang.org/x/net/http2 code.
- Inventory openSUSE Leap 16.0 hosts with 'rpm -qa cadvisor*' to scope which container monitoring nodes still carry a cadvisor build earlier than 0.60.6-bp160.4.1.
- Track SUSE bug references bsc#1288588 (zstd decoder panic) and bsc#1288212 (golang.org/x/net/http2 flow control) in the change record so the Leap 16.0 patch state can be audited against both CVEs.
- Rebuild container images and other systems based on openSUSE Leap 16.0 that include the cadvisor package so they pick up the openSUSE-Leap-16.0-packagehub-719 patch content and ship cadvisor-0.60.6-bp160.4.1.
