CVE-2026-56864

.

Security Fix(es):

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56864)

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56865)

.

Security Fix(es):

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56864)

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56865)

.

Security Fix(es):

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56864)

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56865)

.

Security Fix(es):

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56864)

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56865)

.

Security Fix(es):

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56864)

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy(CVE-2026-56865)

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56853 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Previously, this was being done with no timeout applied. ReadHeaderTimeout is now applied for this. CVE-2026-56860 Previously, resolving relative paths containing parent directory (|..|) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. CVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. CVE-2026-56862 Previously, we always counted handshake messages, such as KeyUpdate, as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. CVE-2026-56858 Previously, pathological inputs could close an unescaped |/| early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returned the name "example.com" rather than an error. CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.26-1.26.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.27-1.27rc3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for go1.25 fixes the following issues:

Update to go1.25.13 (released 2026-08-13, bsc#1244485).

Security issues fixed:

• CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service (bsc#1275028).
• CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).
• CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion and a denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic time complexity in resolvePath when processing certain input can lead to high memory allocation overhead and a denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in Lookup allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input and can lead to malicious module content to be accepted (bsc#1275024).

Changes for go1.25.13:

• go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits
• go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
• go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
• go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
• go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
• go#80393 runtime: arm64 found pointer to free object with safe code
• go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
• go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
• go#80500 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
• go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
• go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
• go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
• go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
• go#80618 cmd/compile: prove bug causes invalid indirect call
• go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

This update for go1.26 fixes the following issues:

Update to go1.26.6 (released 2026-08-13, bsc#1255111).

Security issues fixed:

• CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service (bsc#1275028).
• CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).
• CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion and a denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic time complexity in resolvePath when processing certain input can lead to high memory allocation overhead and a denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in Lookup allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input and can lead to malicious module content to be accepted (bsc#1275024).

Changes for go1.26.6:

• go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
• go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
• go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
• go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
• go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
• go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
• go#80394 runtime: arm64 found pointer to free object with safe code
• go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
• go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
• go#80499 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
• go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
• go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
• go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
• go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
• go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
• go#80619 cmd/compile: prove bug causes invalid indirect call
• go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips: (jsc#SLE-18320):
  • Rebase to 1.25.14
• go1.25.14 (released 2026-08-19, boo#1244485):
  • go#80926 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.25.13 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net/http, and net/url packages, as well as bug fixes to the compiler, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove miscompilation in slicemask folding leaves garbage in the upper bits
  • go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80393 runtime: arm64 found pointer to free object with safe code
  • go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80500 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80614 cmd/compile: mips64le miscompiles OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80618 cmd/compile: prove bug causes invalid indirect call
  • go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load
• Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:
  • Limit openssl RandReader concurrency (#374)

This update for go1.26-openssl fixes the following issues:

Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips: (jsc#SLE-18320).
  • Rebase to 1.26.7
  • Support strictfipsruntime with no_openssl
  • Fix multiple no_openssl build tag issues
• go1.26.7 (released 2026-08-19, boo#1255111):
  • go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.26.6 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages, as well as bug fixes to the compiler, the linker, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
  • go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
  • go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80394 runtime: arm64 found pointer to free object with safe code
  • go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80499 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
  • go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames *…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5026 CVE-2026-39821
  • GO-2026-6225
  • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
  • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
  • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
  • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
  • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
  • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
  • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
  • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
  • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
  • GO-2026-6262 GHSA-22w5-2fxg-vrwx
  • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
  • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
  • GO-2026-6265 GHSA-8fxq-53rx-ph5f
  • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
  • GO-2026-6267 GHSA-h58c-xccx-75m3
  • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
  • GO-2026-6269 GHSA-rxhg-vcww-2mpw
  • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
  • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
  • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
  • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
  • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
  • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
  • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
  • GO-2026-6278 GHSA-w67g-5rqw-f597
  • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
  • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
  • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
  • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
  • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
  • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
  • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
  • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
  • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
  • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
  • GO-2026-6289 GHSA-w8j7-39hp-8x59
  • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
  • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
  • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
  • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
  • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
  • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
  • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
  • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
  • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
  • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
  • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
  • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

• Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4720 GHSA-v3mg-9v85-fcm7
  • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
  • GO-2026-4950
  • GO-2026-6093 GHSA-464c-974j-9xm6
  • GO-2026-6094 GHSA-gcjh-h69q-9w9g
  • GO-2026-6095 GHSA-r277-6w6q-xmqw
  • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
  • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
  • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
  • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
  • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
  • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
  • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
  • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
  • GO-2026-6105 GHSA-c534-2w9c-x7fm
  • GO-2026-6106 GHSA-v6w6-358x-2433
  • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
  • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
  • GO-2026-6109 GHSA-86cx-wwf4-phq4
  • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
  • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
  • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
  • GO-2026-6113 GHSA-p6ph-3jx2-3337
  • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
  • GO-2026-6115 CVE-2026-56867
  • GO-2026-6117 GHSA-hp74-gm6m-2qm5
  • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
  • GO-2026-6119 CVE-2026-43983…

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for cosign fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).
• Verification bypass via public key in legacy bundle (bsc#1282542).

Changes for cosign:

• update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):

• This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.
• Auto-detect default digest algorithm for public keys
• fix(pkcs11key): return an error instead of panicking when no key pair matches
• Supporting OCI Signing with X.509 Certificate Chain
• test(inspect): replace mock TSA client usage with local timestamp response generator in
• fix: prevent shell completions for various options not taking filenames
• fix(blob): compare file checksums case-insensitively in
• Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98)

Root has patched CVE-2026-56864 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available.

This update for go1.25 fixes the following issues:

Update to go1.25.13 (released 2026-08-13, bsc#1244485).

Security issues fixed:

• CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service (bsc#1275028).
• CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).
• CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion and a denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic time complexity in resolvePath when processing certain input can lead to high memory allocation overhead and a denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in Lookup allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input and can lead to malicious module content to be accepted (bsc#1275024).

Changes for go1.25.13:

• go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits
• go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
• go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
• go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
• go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
• go#80393 runtime: arm64 found pointer to free object with safe code
• go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
• go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
• go#80500 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
• go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
• go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
• go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
• go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
• go#80618 cmd/compile: prove bug causes invalid indirect call
• go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

This update for go1.26 fixes the following issues:

Update to go1.26.6 (released 2026-08-13, bsc#1255111).

Security issues fixed:

• CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service (bsc#1275028).
• CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).
• CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion and a denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic time complexity in resolvePath when processing certain input can lead to high memory allocation overhead and a denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in Lookup allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input and can lead to malicious module content to be accepted (bsc#1275024).

Changes for go1.26.6:

• go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
• go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
• go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
• go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
• go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
• go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
• go#80394 runtime: arm64 found pointer to free object with safe code
• go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
• go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
• go#80499 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
• go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
• go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
• go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
• go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
• go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
• go#80619 cmd/compile: prove bug causes invalid indirect call
• go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips: (jsc#SLE-18320):
  • Rebase to 1.25.14
• go1.25.14 (released 2026-08-19, boo#1244485):
  • go#80926 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.25.13 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net/http, and net/url packages, as well as bug fixes to the compiler, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove miscompilation in slicemask folding leaves garbage in the upper bits
  • go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80393 runtime: arm64 found pointer to free object with safe code
  • go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80500 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80614 cmd/compile: mips64le miscompiles OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80618 cmd/compile: prove bug causes invalid indirect call
  • go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load
• Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:
  • Limit openssl RandReader concurrency (#374)

This update for go1.26-openssl fixes the following issues:

Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips: (jsc#SLE-18320).
  • Rebase to 1.26.7
  • Support strictfipsruntime with no_openssl
  • Fix multiple no_openssl build tag issues
• go1.26.7 (released 2026-08-19, boo#1255111):
  • go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.26.6 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages, as well as bug fixes to the compiler, the linker, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
  • go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
  • go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80394 runtime: arm64 found pointer to free object with safe code
  • go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80499 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
  • go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames *…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-5026 CVE-2026-39821
  • GO-2026-6225
  • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
  • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
  • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
  • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
  • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
  • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
  • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
  • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
  • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
  • GO-2026-6262 GHSA-22w5-2fxg-vrwx
  • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
  • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
  • GO-2026-6265 GHSA-8fxq-53rx-ph5f
  • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
  • GO-2026-6267 GHSA-h58c-xccx-75m3
  • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
  • GO-2026-6269 GHSA-rxhg-vcww-2mpw
  • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
  • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
  • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
  • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
  • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
  • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
  • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
  • GO-2026-6278 GHSA-w67g-5rqw-f597
  • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
  • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
  • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
  • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
  • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
  • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
  • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
  • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
  • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
  • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
  • GO-2026-6289 GHSA-w8j7-39hp-8x59
  • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
  • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
  • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
  • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
  • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
  • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
  • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
  • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
  • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
  • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
  • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
  • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

• Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4720 GHSA-v3mg-9v85-fcm7
  • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
  • GO-2026-4950
  • GO-2026-6093 GHSA-464c-974j-9xm6
  • GO-2026-6094 GHSA-gcjh-h69q-9w9g
  • GO-2026-6095 GHSA-r277-6w6q-xmqw
  • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
  • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
  • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
  • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
  • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
  • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
  • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
  • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
  • GO-2026-6105 GHSA-c534-2w9c-x7fm
  • GO-2026-6106 GHSA-v6w6-358x-2433
  • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
  • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
  • GO-2026-6109 GHSA-86cx-wwf4-phq4
  • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
  • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
  • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
  • GO-2026-6113 GHSA-p6ph-3jx2-3337
  • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
  • GO-2026-6115 CVE-2026-56867
  • GO-2026-6117 GHSA-hp74-gm6m-2qm5
  • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
  • GO-2026-6119 CVE-2026-43983…

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).
• CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

This update for cosign fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).
• Verification bypass via public key in legacy bundle (bsc#1282542).

Changes for cosign:

• update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):

• This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.
• Auto-detect default digest algorithm for public keys
• fix(pkcs11key): return an error instead of panicking when no key pair matches
• Supporting OCI Signing with X.509 Certificate Chain
• test(inspect): replace mock TSA client usage with local timestamp response generator in
• fix: prevent shell completions for various options not taking filenames
• fix(blob): compare file checksums case-insensitively in
• Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98)

This update for helm fixes the following issues:

• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758).
• CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939).
• CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935).
• CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938).
• CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
• CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428).
• CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127).
• CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).
• CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).
• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
• CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642).
• CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).
• CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468).
• CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469).
• CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112).
• gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514).

Changes for helm:

• update to 4.3.0:

• feat: Add duration functions
• feat(engine): add debug logging when lookup returns empty
• feat: add ownership verification before deleting resources
• feat: honor SOURCE_DATE_EPOCH for chart archives
• feat(rollback): add --description flag to provide rollback reason
• fix (internal/plugin): remove zero-width spaces from plugin name comment
• fix(loader): do not drop values files ending at a 4096-byte boundary
• fix(chart): normalize StampModTimes timestamp to UTC/truncate

• Chart.lock reproducibility test

• fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
• fix(template): regression - route registry messages to stderr in template and show
• refactor: lower resync period from one hour to 3 minutes
• perf: enable concurrent status computation to prevent multi-minute delays
• fix: Improve error reporting for helm template --debug with --show-only- #31185
• fix: fetch logs from all containers in test pods- #32099
• fix(provenance): check error return in Digest and encodeRelease- #32136
• fix panic on repeated IsReachable calls- #32184
• fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211
• Fix missing conflict retry with server-side apply- #32088
• Properly format the extra field in gzipped…

This update for go1.25 fixes the following issues:

Security issues fixed:

• CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).
• CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).
• CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).
• CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).
• CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).

Non security issue fixed:

• go1.25 release tracking (bsc#1244485).

Changes for go1.25:

• update to go1.25.13

• go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits
• go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
• go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
• go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
• go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
• go#80393 runtime: arm64 found pointer to free object with safe code
• go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
• go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
• go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
• go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
• go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
• go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
• go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
• go#80618 cmd/compile: prove bug causes invalid indirect call
• go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

This update for go1.26 fixes the following issues:

Security issues fixed:

• CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).
• CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).
• CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).
• CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).
• CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).

Non security issue fixed:

• go1.26 release tracking (bsc#1255111).

Changes for go1.26:

• update to go1.26.6

• go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
• go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
• go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
• go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
• go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
• go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
• go#80394 runtime: arm64 found pointer to free object with safe code
• go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
• go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
• go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
• go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
• go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
• go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
• go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
• go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
• go#80619 cmd/compile: prove bug causes invalid indirect call
• go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load

This update for go1.26-openssl fixes the following issues:

Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips: (jsc#SLE-18320).
  • Rebase to 1.26.7
  • Support strictfipsruntime with no_openssl
  • Fix multiple no_openssl build tag issues
• go1.26.7 (released 2026-08-19, boo#1255111):
  • go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.26.6 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages, as well as bug fixes to the compiler, the linker, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
  • go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
  • go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80394 runtime: arm64 found pointer to free object with safe code
  • go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
  • go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80619…

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips: (jsc#SLE-18320):
  • Rebase to 1.25.14
• go1.25.14 (released 2026-08-19, boo#1244485):
  • go#80926 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.25.13 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net/http, and net/url packages, as well as bug fixes to the compiler, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove miscompilation in slicemask folding leaves garbage in the upper bits
  • go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80393 runtime: arm64 found pointer to free object with safe code
  • go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80614 cmd/compile: mips64le miscompiles OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80618 cmd/compile: prove bug causes invalid indirect call
  • go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load
• Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:
  • Limit openssl RandReader concurrency (#374)

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips: (jsc#SLE-18320):
  • Rebase to 1.25.14
• go1.25.14 (released 2026-08-19, boo#1244485):
  • go#80926 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.25.13 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net/http, and net/url packages, as well as bug fixes to the compiler, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove miscompilation in slicemask folding leaves garbage in the upper bits
  • go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80364 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80393 runtime: arm64 found pointer to free object with safe code
  • go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80614 cmd/compile: mips64le miscompiles OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80618 cmd/compile: prove bug causes invalid indirect call
  • go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load
• Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:
  • Limit openssl RandReader concurrency (#374)

This update for go1.26-openssl fixes the following issues:

Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips: (jsc#SLE-18320).
  • Rebase to 1.26.7
  • Support strictfipsruntime with no_openssl
  • Fix multiple no_openssl build tag issues
• go1.26.7 (released 2026-08-19, boo#1255111):
  • go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.26.6 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages, as well as bug fixes to the compiler, the linker, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
  • go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
  • go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80394 runtime: arm64 found pointer to free object with safe code
  • go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
  • go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80619…

This update for go1.27 fixes the following issues:

• go1.27.0 (released 2026-08-19) is a major release of Go. go1.27.x minor releases will be provided through August 2027. https://github.com/golang/go/wiki/Go-Release-Cycle go1.27 arrives six months after Go 1.26. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. (bsc#1272545)

  • Language change: Go 1.27 now supports generic methods: a method declaration may declare its own type parameters. This widely anticipated change allows adding generic functions within the namespace of a particular data type where before one had to declare such functions with a scope of the entire package.
  • Language change: A key in a struct literal may now be any valid field selector for the struct type, not just a (top-level) field name of the struct.
  • Language change: Function type inference has been generalized to apply in all contexts where a generic function is assigned to a variable of (or converted to) a matching function type.
  • Tools: Response file (@file) parsing is now supported for the compile, link, asm, cgo, cover, and pack tools. The response file contains whitespace-separated arguments with support for single-quoted and double-quoted strings, escape sequences, and backslash-newline line continuation. The format is compatible with GCC’s response file implementation to ensure interoperability with existing build systems.
  • go command: The go command no longer has support for the bzr version control system. It will no longer be able to directly fetch modules hosted on bzr servers.
  • godebug: Starting with Go 1.27, the go command now recognizes a GODEBUG setting for which support was removed (such as asynctimerchan, see below) if it appears in go.mod files (godebug entries) and .go source files (//go:debug comments). It accepts these settings if they are set to the final default value established before the setting was removed. If they are set to an old value, the go command will fail. This change is in the spirit of the Go 1 compatibility guarantee and allows existing programs that set supported GODEBUG settings to continue to build and run without changes even when the respective setting support has been removed.
  • go test: go test now invokes the stdversion vet check by default. This reports the use of standard library symbols that are too new for the Go version in force in the referring file, as determined by go directive in go.mod and build tags on the file.
  • go test: go test -json now annotates 'Action':'output' lines with an optional new field 'OutputType', specifying the type of output. Currently, the possible values include “error”, “error-continue”, and “frame”. See cmd/test2json help for details.
  • go doc: The go doc command now supports package@version syntax, such as go doc example.com/[email protected].
  • go doc: The go doc command now accepts the -ex command-line option to list executable examples of the given package or symbol. When an example name is passed on the command line (such as go doc bytes.ExampleBuffer), go doc now prints the example source code along with comments.
  • go fix: The go fix command contains several new modernizers (atomictypes, embedlit, slicesbackward, and unsafefuncs).
  • go fix: The existing fmtappendf analyzer was removed due to stylistic concerns.
  • go fix: The existing waitgroup analyzer was renamed to waitgroupgo to avoid ambiguity.
  • go mod tidy: For modules specifying go 1.27 or later in their go.mod file, go mod tidy now automatically merges duplicate require blocks. This ensures the file maintains a clean, standard structure containing…

This update for cosign fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278614).
• CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).
• Verification bypass via public key in legacy bundle (bsc#1282542).

Changes for cosign:

• update to 3.1.3:

• Auto-detect default digest algorithm for public keys
• fix(pkcs11key): return an error instead of panicking when no key pair matches
• Supporting OCI Signing with X.509 Certificate Chain
• fix: prevent shell completions for various options not taking filenames
• fix(blob): compare file checksums case-insensitively in
• Verification bypass via public key in legacy bundle (GHSA- fx35-mq7g-6g98, bsc#1282542)