SUSE-SU-2026:23573-1: go1.25-openssl&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:23573-1 is a vulnerability in go1.25-openssl&distro=SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 30-08-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for go1.25-openssl This update for go1.25-openssl fixes the following issues: Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609). - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028). - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS (bsc#1275033). - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026). - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to denial of service (bsc#1275029). - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032). - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025). - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024). Other updates and bugfixes: - Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips: (jsc#SLE-18320): * Rebase to 1.25.14 - go1.25.14 (released 2026-08-19, boo#1244485): * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff - go1.25.13 (released 2026-08-13): * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os` packages. * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr` * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880 * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880 * go#80393 runtime: `arm64` found pointer to free object with safe code * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following garbage stack data as a pointer * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field * go#80500 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of spills * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames * go#80618 cmd/compile: `prove` bug causes invalid indirect call * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load - Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips: * Limit openssl `RandReader` concurrency (#374)

No weakness data has been published for this record.