This update for go1.26 fixes the following issues:
Update to go1.26.10 (bsc#1255111):
- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).
- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).
- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,
bsc#1286261).
This update for go1.26 fixes the following issues:
Update to go 1.26.9 (bsc#1255111):
- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).
- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).
- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).
- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).
- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).
- CVE-2026-94439: net/http: HTTP/1 server connection desynchro
This update for go1.26 fixes the following issues
- Update to version go1.26.5 (bsc#1255111)
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
This update for go1.26 fixes the following issues
Update to go1.26.4 (bsc#1255111):
- CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
- CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
- CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping (bsc#1267444).
Changes:
* go#79230 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in WordDecoder.DecodeHeader
* go#79426 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included in errors
without any escaping
* go#79701 go#796
This update for go1.26 fixes the following issues:
- Update to go1.26.2 (bsc#1255111).
- CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
- CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
- CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
- CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
- CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
- CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
- CVE-2026-32283: crypt
This update for go1.26 fixes the following issues:
Update to go1.26.1 (bsc#1255111):
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints (bsc#1259266).
- CVE-2026-27138: crypto/x509: panic in name constraint checking for malformed certificates (bsc#1259267).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
Changelog:
* go#77252 cmd/compile: miscompile of global array initialization
* go#77407 os: Go 1.25.x regressi