openSUSE-SU-2026:21613-1 Security update for bugwarden
An attacker can cause a denial of service in bugwarden by sending unbounded empty DATA frames via the h2 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2026:21613-1?
openSUSE-SU-2026:21613-1 is a denial of service vulnerability in bugwarden, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for bugwarden fixes the following issues:
Changes in bugwarden:
Update to 0.5.0:
- Let the environment set allowed hosts and the auth header
- Require a bearer token on the HTTP transport
- Export audit records and diagnostics to an OTLP collector
- Handle SIGTERM so container stop is graceful
- Refuse unparsable allowed-hosts at startup
- Normalize tool schemas for Gemini/Vertex clients, and recurse portable_schema into all draft-2020-12 positions
Vendored h2 bumped to 0.4.16 for RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h (h2 unbounded empty DATA frames lead to denial of service)
Ship the worked OpenTelemetry collector example as documentation
Which versions are affected by openSUSE-SU-2026:21613-1?
Linux distribution packages (1)
bugwarden openSUSE:Leap 16.0 | All versions | 0.5.0-bp160.1.1 |
How do I fix openSUSE-SU-2026:21613-1?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is openSUSE-SU-2026:21613-1 being exploited?
There is no known exploitation of openSUSE-SU-2026:21613-1 in the wild and no public exploit code.