SUSE-SU-2026:22572-1

This update for go1.26-openssl fixes the following issues:

Update to go1.26.4 (bsc#1255111).

Security issues fixed:

• CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
• CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
• CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
• CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
• CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
• CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
• CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
• CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock (bsc#1261659).
• CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
• CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
• CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains (bsc#1261662).
• CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508).
• CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1264506).
• CVE-2026-39817: cmd/go: go tool pack does not sanitize output paths (bsc#1264505).
• CVE-2026-39819: cmd/go: go bug follows symlinks in predictable temporary filenames (bsc#1264504).
• CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503).
• CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509).
• CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters (bsc#1264500).
• CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507).
• CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501).
• CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502).
• CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499).
• CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
• CVE-2026-42507: net/textproto: arbitrary input is included in errors without any escaping (bsc#1267444).

Other updates and security fixes:

• Go packages miss binutils-gold dependency (bsc#1170826).
• Drop subpackage go1.x-libstd std library .so refs (jsc#PED-1962).
• Use libalternatives only on suse_version >= 1610 and keep update-alternatives support for older distributions.
• Drop the update-alternatives migration path for libalternatives builds.
• Enable libalternatives for SLE16.1 and Tumbleweed (bsc#1245878).
• Drop go1.26 dependency on update-alternatives (bsc#1264395)
• Update to version 1.26.3 cut from the go1.25-fips-release branch at the revision tagged go1.26.3-1-openssl-fips (jsc#SLE-18320).