CVE-2026-25680

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mcphost-0.34.0-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the yq-4.53.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the hauler-1.4.3-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.71.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the git-bug-0.10.1-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-11.6.14+security04-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the alloy-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the amfora-1.11.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cosign-3.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the lux-0.24.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the system-user-zabbix-7.0.28-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the percona-toolkit-3.7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for yq fixes the following issues:

Changes in yq:

• Fix multiple CVEs:

  • CVE-2026-27136 (GO-2026-5030) CVE-2026-25681 (GO-2026-5029) CVE-2026-25680 (GO-2026-5028) CVE-2026-42502 (GO-2026-5027) CVE-2026-42506 (GO-2026-5025) (bsc#1267053) CVE-2026-39821 (GO-2026-5026) (bsc#1267199)

• update to v4.53.2

  • Add system(command; args) operator (disabled by default).
  • TOML encoder: prefer readable table sections over inline tables.
  • Fix TOML encoder to quote keys containing special characters.
  • Add string slicing support.
  • Fix findInArray misuse on MappingNodes in equality and contains.
  • Fix panic on negative slice indices that underflow after adjustment.
  • Fix stack overflow from circular alias in traverse.
  • Fix panic and OOM in repeatString for large repeat counts.

• update to v4.52.5

  • Fix: reset TOML decoder state between files.
  • Fix: preserve original filename when using --front-matter.

• Integrate vulnchecker support into %check stage (optional: set %%_with_vulncheck 1).

• Fix CVE-2026-33814 (bsc#1266248):

  • update golang.org/x/net to v0.53.0.

• update to 4.52.4:

  • Dropping windows/arm - no longer supported in cross-compile
  • Fixing comments in TOML arrays
  • Bumped dependencies

• update to 4.52.2:

  • Fixed bad instructions file breaking go-install (#2587) Thanks @theyoprst
  • Fixed TOML table scope after comments (#2588) Thanks @tomers
  • Multiply uses a readonly context
  • Fixed merge globbing wildcards in keys
  • Fixing TOML subarray parsing issue

• update to 4.52.1:

  • TOML encoder support - you can now roundtrip! #1364
  • Parent now supports negative indices, and added a 'root' command for referencing the top level document
  • Fixed scalar encoding for HCL
  • Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#2583) Thanks @jfenal
  • Add symlink check to file rename util (#2576) Thanks @Elias- elastisys
  • Powershell fixed default command used for __completeNoDesc alias (#2568) Thanks @teejaded
  • Unwrap scalars in shell output mode. (#2548) Thanks @flintwinters
  • Added K8S KYAML output format support (#2560) Thanks @robbat2

• update to 4.50.1:

  • Added HCL Support - First cut - hopefully it works well!
  • Fixing handling of CRLF #2352

• update to 4.49.2:

  • Fixing escape character bugs :sweat: #2517
  • Fixing snap release pipeline #2518 Thanks @aalexjo

• update to 4.49.1:

  • Added --security flags to disable env and file ops #2515
  • Fixing TOML ArrayTable parsing issues #1758
  • Fixing parsing of escaped characters #2506

• update to 4.48.2:

  • Strip whitespace when decoding base64 #2507
  • Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)
  • Add linux/loong64 to release target (thanks @znley)
  • Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

• update to 4.48.1:

  • Added 'parents' operator, to return a list of all the hierarchical parents of a node
  • Added 'first(exp)' operator, to return the first entry matching an expression in an array
  • Fixed xml namespace prefixes #1730 (thanks @baodrate)
  • Fixed out of range panic in yaml decoder #2460 (thanks @n471d)
  • Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540) CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by updating golang.org/x/net to v0.46.0.

• update to 4.47.2:

  • Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @louislouislouislouis)

• update to 4.47.1:

  • Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @stevenwdv!

• Fix zsh completion location

• update to 4.46.1:

  • Added INI support
  • Fixed 'add' operator when piped in with no data #2378, #2383, #2384
  • Fixed delete after slice problem (bad node path) #2387 Thanks @antoinedeschenes
  • Fixed yq small build Thanks @imzue
  • Switched to YAML org supported go-yaml!

• update to 4.45.4:

  • Fixing…

This update for trivy fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267047).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265648).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266495).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266075).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).

Changes for trivy:

• Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):

• release: v0.71.0 [main] (#10638)
• ci: use only the first line of commit message in release-please workflow (#10766)
• feat: add WithDriver and WithProvider options to ospkg detector (#10740)
• chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
• refactor(secret): normalize configPath once in Init (#10702)
• feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704)
• chore(deps): bump the common group across 1 directory with 25 updates (#10758)
• chore: migrate from gomodguard to gomodguard_v2 (#10739)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)
• ci: scope GitHub App tokens to minimum required permissions (#10755)
• chore(deps): upgrade go-redis from v8 to v9 (#10736)
• fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
• fix(misconf): skip resources with no after changes (#10352)
• fix(misconf): reject nil plays during playbook parsing (#10273)
• fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
• fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
• refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
• chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
• fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
• fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions…

This update for neonmodem fixes the following issues:

Changes in neonmodem:

• Update golang.org/x/net dependency to v0.55.0 due to bsc#1267193

• Update golang.org/x/image dependency to v0.38.0 due to bsc#1260727

• Update golang.org/x/term dependency to v0.42.0 due to bsc#1260727

• Update to version 1.0.7+git0.346d1d3:

  • Update dependencies, remove debug output
  • Update GitHub actions
  • discourse: APi fixes
  • Bump golang.org/x/net from 0.36.0 to 0.38.0
  • Bump golang.org/x/net from 0.34.0 to 0.36.0
  • Update dependencies
  • Change chat button

• Add build option for position-independent executables