This update for go1.26 fixes the following issues:
Update to go 1.26.10 (bsc#1255111):
- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).
- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).
- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,
bsc#1286261).
This update for go1.26 fixes the following issues:
Update to go 1.26.9 (bsc#1255111):
- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).
- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).
- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).
- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).
- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).
- CVE-2026-94439: net/http: HTTP/1 server connection desynchro
This update for go1.26 fixes the following issues:
Update to go1.26.6 (released 2026-08-13, bsc#1255111).
Security issues fixed:
- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,
recursive structures (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service
(bsc#1275028).
- CVE-2026-56858: html/template: improper Javascript regexp context t
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.26 fixes the following issues
- Update to version go1.26.5 (bsc#1255111).
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
This update for go1.26 fixes the following issues
Update to go1.26.4 (bsc#1255111):
- CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
- CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
- CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping (bsc#1267444).
Changes:
* go#79230 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in WordDecoder.DecodeHeader
* go#79426 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included in errors
without any escaping
* go#79701 go#7969