SUSE-SU-2026:22572-1

SUSE-SU-2026:22572-1 · Security update for go1.26-openssl

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

This update for go1.26-openssl fixes the following issues: Update to go1.26.4 (bsc#1255111). Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653). - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654). - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655). - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450). - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656). - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657). - CVE-2026-32282: os: `Root.Chmod` can follow symlinks out of the root on Linux (bsc#1261658). - CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock (bsc#1261659). - CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660). - CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661). - CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains (bsc#1261662). - CVE-2026-33811: net: crash when handling long `CNAME` response (bsc#1264508). - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad `SETTINGS_MAX_FRAME_SIZE` (bsc#1264506). - CVE-2026-39817: cmd/go: `go tool pack` does not sanitize output paths (bsc#1264505). - CVE-2026-39819: cmd/go: `go bug` follows symlinks in predictable temporary filenames (bsc#1264504). - CVE-2026-39820: net/mail: quadratic string concatentation in `consumeComment` (bsc#1264503). - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509). - CVE-2026-39825: net/http/httputil: `ReverseProxy` forwards queries with more than `urlmaxqueryparams` parameters (bsc#1264500). - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507). - CVE-2026-39836: net: panic in `Dial` and `LookupPort` when handling `NUL` byte on Windows (bsc#1264501). - CVE-2026-42499: net/mail: quadratic string concatenation in `consumePhrase` (bsc#1264502). - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499). - CVE-2026-42504: mime: quadratic complexity in `WordDecoder.DecodeHeader` (bsc#1267442). - CVE-2026-42507: net/textproto: arbitrary input is included in errors without any escaping (bsc#1267444). Other updates and security fixes: - Go packages miss `binutils-gold` dependency (bsc#1170826). - Drop subpackage `go1.x-libstd` `std` library `.so` refs (jsc#PED-1962). - Use `libalternatives` only on `suse_version >= 1610` and keep `update-alternatives` support for older distributions. - Drop the `update-alternatives` migration path for `libalternatives` builds. - Enable `libalternatives` for SLE16.1 and Tumbleweed (bsc#1245878). - Drop go1.26 dependency on `update-alternatives` (bsc#1264395) - Update to version 1.26.3 cut from the `go1.25-fips-release` branch at the revision tagged `go1.26.3-1-openssl-fips` (jsc#SLE-18320).

Korrektur verfügbar

Veröffentlicht

2026-07-07T16:59:00Z

Aktualisiert

2026-07-15T18:24:12.010930109Z

Technologie-Stack: system

Prüfen Sie Ihren Server →