libzypp CVE-2026-44942

The primary fix is upgrading libzypp to version 17.38.13 or later in the 17.x series, or to version 16.22.19 or later in the 16.x series, as confirmed by the SUSE advisory at https://www.suse.com/security/cve/CVE-2026-44942.html. On SLES and openSUSE systems this is accomplished via 'zypper update libzypp'. If patching is immediately infeasible, administrators should restrict write access to the zypp repository configuration directory (/etc/zypp/repos.d/) to root only, preventing low-privileged users from introducing malicious .repo files; this mitigates the primary exploitation path but does not address cases where an attacker can influence a privileged process that reads .repo files. Additionally, filesystem quotas or dedicated volume mounts for the zypp cache (/var/cache/zypp/) can limit the blast radius of a disk-filling attack, though this is a containment measure rather than a fix.