OESA-2026-1979

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1979
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-1979.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-1979
Upstream
  • CVE-2026-25679
  • CVE-2026-27139
  • CVE-2026-27142
Published
2026-04-17T13:03:14Z
Modified
2026-04-17T13:20:40.825507Z
Summary
golang security update
Details

.

Security Fix(es):

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.(CVE-2026-25679)

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.(CVE-2026-27139)

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.(CVE-2026-27142)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP2 / golang

Package

Name
golang
Purl
pkg:rpm/openEuler/golang&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.21.4-43.oe2403sp2

Ecosystem specific 

{
    "aarch64": [
        "golang-1.21.4-43.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "golang-1.21.4-43.oe2403sp2.x86_64.rpm"
    ],
    "src": [
        "golang-1.21.4-43.oe2403sp2.src.rpm"
    ],
    "noarch": [
        "golang-devel-1.21.4-43.oe2403sp2.noarch.rpm",
        "golang-help-1.21.4-43.oe2403sp2.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1979.json"