openSUSE-SU-2026:20496-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20496-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:20496-1

Upstream

CVE (3)

Related

CVE (3)

Published

2026-04-16T07:24:09Z

Modified

2026-04-22T18:26:27Z

Summary

Security update for go1.25

Details

This update for go1.25 fixes the following issues:

Update to go1.25.8 (bsc#1244485):

CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).

Changelog:

go#77253 cmd/compile: miscompile of global array initialization
go#77406 os: Go 1.25.x regression on RemoveAll for windows
go#77413 runtime: netpollinit() incorrectly prints the error from linux.Eventfd
go#77438 cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable flag in pkg-config
go#77531 net/smtp: expiry date of localhostCert for testing is too short

References

Affected packages

openSUSE:Leap 16.0 / go1.25

Package

Name: go1.25
Purl: pkg:rpm/opensuse/go1.25&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.25.8-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "go1.25":  "1.25.8-160000.1.1",
            "go1.25-doc":  "1.25.8-160000.1.1",
            "go1.25-libstd":  "1.25.8-160000.1.1",
            "go1.25-race":  "1.25.8-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20496-1.json"