This update for go1.26-openssl fixes the following issues:
Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips.
Security issues fixed:
- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial
of service (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support
unencrypted HTTP/2 allows fo
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.26-openssl fixes the following issues
- Update to version go1.26.5 (bsc#1255111).
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
This update for go1.26-openssl fixes the following issues:
Update to go1.26.4 (bsc#1255111).
Security issues fixed:
- CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
- CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
- CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
- CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
- CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
- CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
- C
This update for go1.26-openssl fixes the following issues:
Update to go 1.26.1 (bsc#1255111, jsc#SLE-18320):
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints (bsc#1259266).
- CVE-2026-27138: crypto/x509: panic in name constraint checking for malformed certificates (bsc#1259267).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
Changelog:
* Fix fips140only test in boring mode
* Fix fips140 only test
* Add GODE