SUSE-SU-2026:3815-1: important: Security update for go1.25-openssl

OPENSUSE-SECURITY-UPDATES <[email protected]>
Newsgroups gmane.linux.suse.security.announce
Message-ID <178776292033.9443.4067856694766760858@6f3a8d4f1c47> 
# Security update for go1.25-openssl

Announcement ID: SUSE-SU-2026:3815-1  
Release Date: 2026-08-26T11:02:14Z  
Rating: important  
References:

  * bsc#1244485
  * bsc#1266609
  * bsc#1275024
  * bsc#1275025
  * bsc#1275026
  * bsc#1275028
  * bsc#1275029
  * bsc#1275032
  * bsc#1275033
  * bsc#1275034
  * jsc#SLE-18320

  
Cross-References:

  * CVE-2026-33818
  * CVE-2026-39821
  * CVE-2026-56853
  * CVE-2026-56858
  * CVE-2026-56859
  * CVE-2026-56860
  * CVE-2026-56862
  * CVE-2026-56864
  * CVE-2026-56865

  
CVSS scores:

  * CVE-2026-33818 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-33818 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-39821 ( SUSE ):  9.1
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-39821 ( SUSE ):  7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-39821 ( NVD ):  8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-39821 ( NVD ):  9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-56853 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56853 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56858 ( SUSE ):  6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2026-56858 ( NVD ):  6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2026-56859 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56859 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56860 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-56860 ( NVD ):  5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56862 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56862 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56864 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
  * CVE-2026-56864 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-56865 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-56865 ( NVD ):  8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  
Affected Products:

  * Development Tools Module 15-SP7
  * openSUSE Leap 15.6
  * SUSE Linux Enterprise Desktop 15 SP7
  * SUSE Linux Enterprise Real Time 15 SP7
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server 15 SP6 LTSS
  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7

  
  
An update that solves nine vulnerabilities, contains one feature and has one
security fix can now be installed.

## Description:

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.14 cut from the go1.25-fips-release branch at the
revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

  * CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested,
    recursive structures can lead to denial of service (bsc#1275034).
  * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
    Punycode-encoded labels allows for validation bypass and privilege
    escalation (bsc#1266609).
  * CVE-2026-56853: net/http: first header read timeout not being applied when a
    server is configured to support unencrypted HTTP/2 allows for denial of
    service (bsc#1275028).
  * CVE-2026-56858: html/template: wrong JavaScript regexp context tracking
    after top-level `{` can lead to XSS (bsc#1275033).
  * CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard
    bypass during decoding operations can lead to denial of service
    (bsc#1275026).
  * CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when
    processing backtrack path elements can lead to denial of service
    (bsc#1275029).
  * CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing
    record limit in TLS 1.3, which can lead to a denial of service
    (bsc#1275032).
  * CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving
    arbitrary module content not contained within the transparency log
    (bsc#1275025).
  * CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of
    forging sumdb tiles, which allows for bypass of the `GOSUMDB` check and
    persistence of attacker-controlled module contents to a local Go module
    cache (bsc#1275024).

Other updates and bugfixes:

  * Update to version 1.25.14 cut from the go1.25-fips-release branch at the
    revision tagged go1.25.14-1-openssl-fips: (jsc#SLE-18320):
  * Rebase to 1.25.14
  * go1.25.14 (released 2026-08-19, boo#1244485):
  * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted
    HTTP/2 handoff
  * go1.25.13 (released 2026-08-13):
  * includes security fixes to the `go` command, and the `crypto/tls`,
    `encoding/asn1`, `encoding/xml`, `html/template`, `net/http`, and `net/url`
    packages, as well as bug fixes to the compiler, the runtime, and the
    `crypto/tls` and `os` packages.
  * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves
    garbage in the upper bits
  * go#80098 cmd/compile: internal compiler error invalid heap allocated var
    without `Heapaddr`
  * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward
    slashes
  * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
  * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
  * go#80393 runtime: `arm64` found pointer to free object with safe code
  * go#80440 runtime: uninitialized register due to wrong ABI in
    `mach_vm_region_trampoline` leads to `libc` following garbage stack data as
    a pointer
  * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a
    `[]byte` slice field
  * go#80500 runtime: js/wasm: "found bad pointer in Go heap" \-- link-layout-
    constant value recorded as a pointer in the write-barrier buffer
  * go#80578 cmd/compile: `regalloc` uses unreliable type data (like
    `v.Type.IsSigned()`) to choose the restore of spills
  * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret
    enforcement
  * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which
    doesn't fit 32bits resulting in panic
  * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from
    `HI`/`LO` corrupted w/ big stack frames
  * go#80618 cmd/compile: `prove` bug causes invalid indirect call
  * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
  * Update to version 1.25.12 cut from the go1.25-fips-release branch at the
    revision tagged go1.25.12-2-openssl-fips:
  * Limit openssl `RandReader` concurrency (#374)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server 15 SP6 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3815=1

  * Development Tools Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-3815=1

  * openSUSE Leap 15.6  
    zypper in -t patch SUSE-2026-3815=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP6  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3815=1

## Package List:

  * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
    * go1.25-openssl-debuginfo-1.25.14-150600.13.27.1
    * go1.25-openssl-1.25.14-150600.13.27.1
    * go1.25-openssl-race-1.25.14-150600.13.27.1
    * go1.25-openssl-doc-1.25.14-150600.13.27.1
  * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
    * go1.25-openssl-race-1.25.14-150600.13.27.1
  * openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
    * go1.25-openssl-debuginfo-1.25.14-150600.13.27.1
    * go1.25-openssl-1.25.14-150600.13.27.1
    * go1.25-openssl-doc-1.25.14-150600.13.27.1
  * Development Tools Module 15-SP7 (aarch64 ppc64le s390x x86_64)
    * go1.25-openssl-debuginfo-1.25.14-150600.13.27.1
    * go1.25-openssl-1.25.14-150600.13.27.1
    * go1.25-openssl-race-1.25.14-150600.13.27.1
    * go1.25-openssl-doc-1.25.14-150600.13.27.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
    * go1.25-openssl-debuginfo-1.25.14-150600.13.27.1
    * go1.25-openssl-1.25.14-150600.13.27.1
    * go1.25-openssl-race-1.25.14-150600.13.27.1
    * go1.25-openssl-doc-1.25.14-150600.13.27.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-33818.html
  * https://www.suse.com/security/cve/CVE-2026-39821.html
  * https://www.suse.com/security/cve/CVE-2026-56853.html
  * https://www.suse.com/security/cve/CVE-2026-56858.html
  * https://www.suse.com/security/cve/CVE-2026-56859.html
  * https://www.suse.com/security/cve/CVE-2026-56860.html
  * https://www.suse.com/security/cve/CVE-2026-56862.html
  * https://www.suse.com/security/cve/CVE-2026-56864.html
  * https://www.suse.com/security/cve/CVE-2026-56865.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1244485
  * https://bugzilla.suse.com/show_bug.cgi?id=1266609
  * https://bugzilla.suse.com/show_bug.cgi?id=1275024
  * https://bugzilla.suse.com/show_bug.cgi?id=1275025
  * https://bugzilla.suse.com/show_bug.cgi?id=1275026
  * https://bugzilla.suse.com/show_bug.cgi?id=1275028
  * https://bugzilla.suse.com/show_bug.cgi?id=1275029
  * https://bugzilla.suse.com/show_bug.cgi?id=1275032
  * https://bugzilla.suse.com/show_bug.cgi?id=1275033
  * https://bugzilla.suse.com/show_bug.cgi?id=1275034
  * https://jira.suse.com/browse/SLE-18320
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.