SUSE-SU-2026:3641-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20263641-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2026:3641-1

Upstream

CVE (9)

CVE-2026-33818
CVE-2026-39821
CVE-2026-56853
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862
CVE-2026-56864
CVE-2026-56865

Related

CVE (9)

CVE-2026-33818
CVE-2026-39821
CVE-2026-56853
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862
CVE-2026-56864
CVE-2026-56865

Published

2026-08-18T09:06:51Z

Modified

2026-08-18T17:30:04Z

Summary

Security update for go1.26

Details

This update for go1.26 fixes the following issues:

Security issues fixed:

CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).
CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).
CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).
CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).
CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).
CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake (bsc#1275032).
CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).

Non security issue fixed:

go1.26 release tracking (bsc#1255111).

Changes for go1.26:

update to go1.26.6

go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
go#80394 runtime: arm64 found pointer to free object with safe code
go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
go#80619 cmd/compile: prove bug causes invalid indirect call
go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Module for Development Tools 15 SP7

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Server 15 SP4-LTSS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Server 15 SP5-LTSS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Server 15 SP6-LTSS

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP4

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP5

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP6

go1.26

Package

Name: go1.26
Purl: pkg:rpm/suse/go1.26&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.6-150000.1.24.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.26":  "1.26.6-150000.1.24.1",
            "go1.26-doc":  "1.26.6-150000.1.24.1",
            "go1.26-race":  "1.26.6-150000.1.24.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3641-1.json"