{"id":"SUSE-SU-2026:3799-1","summary":"Security update for go1.26-openssl","details":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.\n  \nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:\n  (jsc#SLE-18320).\n  * Rebase to 1.26.7\n  * Support `strictfipsruntime` with `no_openssl`\n  * Fix multiple `no_openssl` build tag issues\n- go1.26.7 (released 2026-08-19, boo#1255111):\n  * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff\n- go1.26.6 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,\n    `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the\n    runtime, and the `crypto/tls` and `os` packages.\n  * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared`\n    on Windows)\n  * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80394 runtime: `arm64` found pointer to free object with safe code\n  * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in\n    the write-barrier buffer\n  * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record\n  * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80619 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:\n  * Limit `openssl` `RandReader` concurrency\n","modified":"2026-08-27T11:01:49.758446371Z","published":"2026-08-25T12:45:13Z","related":["CVE-2026-33818","CVE-2026-39821","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56864","CVE-2026-56865"],"upstream":["CVE-2026-33818","CVE-2026-39821","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56864","CVE-2026-56865"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263799-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1255111"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266609"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275024"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275025"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275026"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275028"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275029"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275032"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275033"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275034"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33818"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56853"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56858"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56859"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56860"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56862"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56864"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56865"}],"affected":[{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl-doc":"1.26.7-150000.1.18.1","go1.26-openssl-race":"1.26.7-150000.1.18.1","go1.26-openssl":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl":"1.26.7-150000.1.18.1","go1.26-openssl-doc":"1.26.7-150000.1.18.1","go1.26-openssl-race":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl-race":"1.26.7-150000.1.18.1","go1.26-openssl":"1.26.7-150000.1.18.1","go1.26-openssl-doc":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl":"1.26.7-150000.1.18.1","go1.26-openssl-doc":"1.26.7-150000.1.18.1","go1.26-openssl-race":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl-race":"1.26.7-150000.1.18.1","go1.26-openssl":"1.26.7-150000.1.18.1","go1.26-openssl-doc":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl":"1.26.7-150000.1.18.1","go1.26-openssl-doc":"1.26.7-150000.1.18.1","go1.26-openssl-race":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl-race":"1.26.7-150000.1.18.1","go1.26-openssl":"1.26.7-150000.1.18.1","go1.26-openssl-doc":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}},{"package":{"name":"go1.26-openssl","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/go1.26-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"ecosystem_specific":{"binaries":[{"go1.26-openssl-doc":"1.26.7-150000.1.18.1","go1.26-openssl-race":"1.26.7-150000.1.18.1","go1.26-openssl":"1.26.7-150000.1.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3799-1.json"}}],"schema_version":"1.9.0"}