{"id":"CVE-2026-56864","aliases":["ALPINE-CVE-2026-56864","AZL-96659","AZL-96671","AZL-98577","BELL-CVE-2026-56864","BIT-golang-2026-56864","DEBIAN-CVE-2026-56864","EUVD-2026-58514","GO-2026-6180","MGASA-2026-0341","OESA-2026-3715","OESA-2026-3716","OESA-2026-3717","OESA-2026-3718","OESA-2026-3899","ROOT-APP-GOBINARY-CVE-2026-56864","SUSE-SU-2026:23300-1","SUSE-SU-2026:23301-1","SUSE-SU-2026:23573-1","SUSE-SU-2026:23576-1","SUSE-SU-2026:23625-1","SUSE-SU-2026:23973-1","SUSE-SU-2026:23984-1","SUSE-SU-2026:24213-1","SUSE-SU-2026:24282-1","SUSE-SU-2026:3640-1","SUSE-SU-2026:3641-1","SUSE-SU-2026:3799-1","SUSE-SU-2026:3800-1","SUSE-SU-2026:3815-1","SUSE-SU-2026:3816-1","SUSE-SU-2026:3830-1","SUSE-SU-2026:4392-1","UBUNTU-CVE-2026-56864","openSUSE-SU-2026:11516-1","openSUSE-SU-2026:11517-1","openSUSE-SU-2026:11536-1","openSUSE-SU-2026:11575-1","openSUSE-SU-2026:11871-1","openSUSE-SU-2026:21592-1","openSUSE-SU-2026:21593-1","openSUSE-SU-2026:21696-1","openSUSE-SU-2026:21705-1","openSUSE-SU-2026:21761-1","openSUSE-SU-2026:21983-1","openSUSE-SU-2026:22064-1"],"status":"published","title":"Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00298,"percentile":0.22665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-08-13T21:43:54Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.26.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.25.14-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"go","fixed_in":["1.25.14-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.26.7-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.25.14-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"go","fixed_in":["1.25.14-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.26.7-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.25.13","1.26.6","1.27.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.26","fixed_in":["1.26.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.27","fixed_in":["1.27~rc3-1"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.25.13","1.26.6","1.27.0-rc.3"],"sources":["osv"]},{"ecosystem":"Go","package":"golang.org/x/mod","fixed_in":["0.40.0"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"golang.org/x/mod","fixed_in":["v0.32.0-aikido.2","v0.32.0-aikido.1","v0.36.0-aikido.1","v0.37.0-aikido.2","v0.21.0-aikido.1","v0.29.0-aikido.1","v0.30.0-aikido.1","v0.16.0-aikido.1","v0.12.0-aikido.1","v0.35.0-aikido.1","v0.24.0-aikido.1","v0.24.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-golang.org/x/mod","fixed_in":["v0.32.0-root.io.2","v0.32.0-root.io.1","v0.36.0-root.io.1","v0.37.0-root.io.2","v0.21.0-root.io.1","v0.29.0-root.io.1","v0.30.0-root.io.1","v0.16.0-root.io.1","v0.12.0-root.io.1","v0.35.0-root.io.1","v0.24.0-root.io.1","v0.24.0-root.io.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.12-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.25.14-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.25.14-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.26.7-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.25.14-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.25.14-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.26.7-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.13"},{"introduced":"1.26.0-0"},{"fixed":"1.26.6"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.12-1","1.24.13-1","1.24.13-2","1.24.4-1","1.24.4-2","1.24.4-3","1.24.4-4","1.24.7-1","1.24.8-1","1.24.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-1"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.2-2","1.26.2-3","1.26.3-1","1.26.3-1~bpo13+1","1.26.3-2","1.26.3-2~bpo13+1","1.26.4-1","1.26.4-1~bpo13+1","1.26.5-1","1.26.5-1~bpo13+1","1.26~rc2-1","1.26~rc3-1","1.26~rc3-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27~rc3-1"}]}],"versions":["1.27~rc1-1","1.27~rc2-1"]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.13"},{"introduced":"1.26.0-0"},{"fixed":"1.26.6"},{"introduced":"1.27.0-0"},{"fixed":"1.27.0-rc.3"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/mod","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.40.0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1.mga10"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1.mga9"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-62.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-50.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-46.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-51.oe2403sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.4-49.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:Go","package":"golang.org/x/mod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.32.0-aikido.2"},{"fixed":"v0.32.0-aikido.1"},{"fixed":"v0.36.0-aikido.1"},{"fixed":"v0.37.0-aikido.2"},{"fixed":"v0.21.0-aikido.1"},{"fixed":"v0.29.0-aikido.1"},{"fixed":"v0.30.0-aikido.1"},{"fixed":"v0.16.0-aikido.1"},{"fixed":"v0.12.0-aikido.1"},{"fixed":"v0.35.0-aikido.1"},{"fixed":"v0.24.0-aikido.1"},{"fixed":"v0.24.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-golang.org/x/mod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.32.0-root.io.2"},{"fixed":"v0.32.0-root.io.1"},{"fixed":"v0.36.0-root.io.1"},{"fixed":"v0.37.0-root.io.2"},{"fixed":"v0.21.0-root.io.1"},{"fixed":"v0.29.0-root.io.1"},{"fixed":"v0.30.0-root.io.1"},{"fixed":"v0.16.0-root.io.1"},{"fixed":"v0.12.0-root.io.1"},{"fixed":"v0.35.0-root.io.1"},{"fixed":"v0.24.0-root.io.1"},{"fixed":"v0.24.0-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-150000.1.24.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150000.1.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150000.1.33.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150600.13.27.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150600.13.27.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-150600.13.27.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150600.13.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150600.13.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-150600.13.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150000.1.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-150400.3.57.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~20.04.1","1.22.2-2~20.04.2","1.22.2-2~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3","1.22.2-2~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4","1.22.2-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27rc3-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.25-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.14-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"go toolchain","product":"cmd/go"},{"vendor":"golang.org/x/mod","product":"golang.org/x/mod/sumdb"}],"references":[{"url":"https://go.dev/issue/80745","tags":["web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["web"]},{"url":"https://go.dev/cl/815000","tags":["web","fix"]},{"url":"https://go.dev/cl/815020","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6180","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56864","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56864","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56864","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0341.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36142","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/13/13","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56865","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3717","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3718","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3899","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623300-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244485","tags":["report"]},{"url":"https://bugzilla.suse.com/1266609","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1275026","tags":["report"]},{"url":"https://bugzilla.suse.com/1275028","tags":["report"]},{"url":"https://bugzilla.suse.com/1275029","tags":["report"]},{"url":"https://bugzilla.suse.com/1275032","tags":["report"]},{"url":"https://bugzilla.suse.com/1275033","tags":["report"]},{"url":"https://bugzilla.suse.com/1275034","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623301-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255111","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623573-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623576-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623625-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77354","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272117","tags":["report"]},{"url":"https://bugzilla.suse.com/1278614","tags":["report"]},{"url":"https://bugzilla.suse.com/1279215","tags":["report"]},{"url":"https://bugzilla.suse.com/1282542","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263640-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263641-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263799-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263800-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263815-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263816-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263830-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272545","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264392-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56864","tags":["report"]},{"url":"https://github.com/golang/go/issues/80745","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56864","title":"Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T21:58:53.605Z","modified":"2026-08-14T16:16:42.248Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-58514","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T21:58:53Z","modified":"2026-08-14T16:16:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:54.910263Z"}],"nvd":[{"id":"CVE-2026-56864","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:22.677Z","modified":"2026-09-03T16:37:52.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"ALPINE-CVE-2026-56864","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:22.677Z","modified":"2026-11-03T06:32:58.091473936Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2026-56864","status":"published","published":"2026-08-18T06:06:10.36676Z","modified":"2026-08-26T07:15:06.517380926Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"DEBIAN-CVE-2026-56864","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:22.677Z","modified":"2026-10-12T11:00:44.663939346Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-3715","title":"golang security update","description":".\r\n\r\nSecurity Fix(es):\n\nEnforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)\n\nPreviously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)\n\nA malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56864)\n\nA malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56865)","status":"published","published":"2026-09-14T16:33:39Z","modified":"2026-09-13T16:45:29.577860883Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3716","title":"golang security update","description":".\r\n\r\nSecurity Fix(es):\n\nEnforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)\n\nPreviously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)\n\nPreviously, resolving relative paths containing parent directory (\u0026apos;..\u0026apos;) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0026apos;..\u0026apos; segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)\n\nA malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56864)\n\nA malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56865)","status":"published","published":"2026-09-14T16:33:39Z","modified":"2026-09-13T16:45:21.945937623Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3717","title":"golang security update","description":".\r\n\r\nSecurity Fix(es):\n\nEnforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)\n\nPreviously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)\n\nPreviously, resolving relative paths containing parent directory (\u0026apos;..\u0026apos;) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0026apos;..\u0026apos; segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)\n\nA malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56864)\n\nA malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56865)","status":"published","published":"2026-09-14T16:33:40Z","modified":"2026-09-13T16:45:30.590767934Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3718","title":"golang security update","description":".\r\n\r\nSecurity Fix(es):\n\nEnforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)\n\nPreviously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)\n\nPreviously, resolving relative paths containing parent directory (\u0026apos;..\u0026apos;) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0026apos;..\u0026apos; segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)\n\nA malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56864)\n\nA malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56865)","status":"published","published":"2026-09-14T16:33:40Z","modified":"2026-09-13T16:45:30.592542287Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3899","title":"golang security update","description":".\r\n\r\nSecurity Fix(es):\n\nEnforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)\n\nPreviously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)\n\nPreviously, resolving relative paths containing parent directory (\u0026apos;..\u0026apos;) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0026apos;..\u0026apos; segments, eliminating the quadratic time complexity and significantly reducing memory allocations.(CVE-2026-56860)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)\n\nA malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56864)\n\nA malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026amp;\u0026amp; go mod tidy(CVE-2026-56865)","status":"published","published":"2026-09-20T13:23:03Z","modified":"2026-09-20T13:30:23.706482908Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-56864","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:00Z","modified":"2026-10-19T17:00:15.261132994Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-96659","title":"CVE-2026-56864 affecting package golang 1.25.12-1","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:22Z","modified":"2026-09-01T05:28:09Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-96671","title":"CVE-2026-56864 affecting package golang 1.26.10-1","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-98577","title":"CVE-2026-56864 affecting package golang 1.27.1-1","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T22:17:22Z","modified":"2026-09-16T06:39:01Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BIT-golang-2026-56864","title":"Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-19T11:37:52.101Z","modified":"2026-08-19T12:25:49.995487491Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2026-6180","title":"Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy","status":"published","published":"2026-08-13T21:43:54Z","modified":"2026-08-19T12:25:49.995487491Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"MGASA-2026-0341","title":"Updated golang packages fix security vulnerabilities","description":"CVE-2026-56865  A malicious GOPROXY was previously capable of forging up\nto two sumdb tiles that allow for a requested module to bypass the\nGOSUMDB check and persist attacker-controlled module content to a local\nGo module cache.\nCVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary\nmodule content not contained within the transparency log.\nCVE-2026-56859 Previously, DecodeElement would reset the depth counter\ncausing it to never fire; this could lead to stack exhaustion.\nCVE-2026-56853 When a server is configured to support unencrypted\nHTTP/2, it reads a few bytes from each new connection to see if they\ncontain the HTTP/2 client preface. Previously, this was being done with\nno timeout applied. ReadHeaderTimeout is now applied for this.\nCVE-2026-56860 Previously, resolving relative paths containing parent\ndirectory (|..|) segments performed string conversions and buffer\nrewrites on each step, resulting in quadratic time complexity and high\nmemory allocation overhead.\nCVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the\nsize of a parameter value overflows the message buffer.\nCVE-2026-56862 Previously, we always counted handshake messages, such as\nKeyUpdate, as state-advancing, regardless of whether a handshake has\nbeen completed or not. As a result, a malicious client can keep sending\nKeyUpdate messages to force the server to keep performing key derivation\noperations indefinitely.\nCVE-2026-56858 Previously, pathological inputs could close an unescaped\n|/| early, allowing for attack-controlled data to inject arbitrary\ncontent, potentially leading to XSS.\nCVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted\nPunycode-encoded labels that decode to an ASCII-only label. For example,\nToUnicode(\"xn--example-.com\") incorrectly returned the name\n\"example.com\" rather than an error.\nCVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack\nexhaustion when parsing deeply-nested, recursive structures.\n","status":"published","published":"2026-08-30T04:17:09Z","modified":"2026-08-30T04:41:21.002923652Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11516-1","title":"go1.25-1.25.13-1.1 on GA media","description":"These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.2652783Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11517-1","title":"go1.26-1.26.6-1.1 on GA media","description":"These are all security issues fixed in the go1.26-1.26.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.233706646Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11536-1","title":"go1.27-1.27rc3-1.1 on GA media","description":"These are all security issues fixed in the go1.27-1.27rc3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-08-19T18:23:34.264184114Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11575-1","title":"helm-4.2.4-1.1 on GA media","description":"These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-22T00:00:00Z","modified":"2026-08-23T11:15:04.029530818Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11871-1","title":"cosign-3.1.3-1.1 on GA media","description":"These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:08.546235303Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21592-1","title":"Security update for go1.25","description":"This update for go1.25 fixes the following issues:\n\nUpdate to go1.25.13 (released 2026-08-13, bsc#1244485).\n\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,\n  recursive structures (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service\n  (bsc#1275028).\n- CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).\n- CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion\n  and a denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can lead to high\n  memory allocation overhead and a denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service\n  (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating GOPROXY and\n  GOSUMDB to serve a client malicious module content (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input\n  and can lead to malicious module content to be accepted (bsc#1275024).\n\nChanges for go1.25.13:\n\n- go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits\n- go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n- go#80364 os: Root's MkdirAll can't create paths ending in forward slashes\n- go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n- go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n- go#80393 runtime: arm64 found pointer to free object with safe code\n- go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following\n  garbage stack data as a pointer\n- go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n- go#80500 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in the\n  write-barrier buffer\n- go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n- go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n- go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n- go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n- go#80618 cmd/compile: prove bug causes invalid indirect call\n- go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","status":"published","published":"2026-08-19T09:07:44Z","modified":"2026-08-21T09:15:09.276594281Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21593-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go1.26.6 (released 2026-08-13, bsc#1255111).\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,\n  recursive structures (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service\n  (bsc#1275028).\n- CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).\n- CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion\n  and a denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can lead to high\n  memory allocation overhead and a denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service\n  (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating GOPROXY and\n  GOSUMDB to serve a client malicious module content (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input\n  and can lead to malicious module content to be accepted (bsc#1275024).\n\nChanges for go1.26.6:\n\n- go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits\n- go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n- go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on\n  Windows)\n- go#80365 os: Root's MkdirAll can't create paths ending in forward slashes\n- go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n- go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n- go#80394 runtime: arm64 found pointer to free object with safe code\n- go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following\n  garbage stack data as a pointer\n- go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n- go#80499 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in\n  the write-barrier buffer\n- go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n- go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n- go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record\n- go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n- go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n- go#80619 cmd/compile: prove bug causes invalid indirect call\n- go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","status":"published","published":"2026-08-19T09:08:44Z","modified":"2026-08-21T09:15:07.18432033Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21696-1","title":"Security update for go1.25-openssl","description":"This update for go1.25-openssl fixes the following issues:\n\nUpdate to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips:\n  (jsc#SLE-18320):\n  * Rebase to 1.25.14\n- go1.25.14 (released 2026-08-19, boo#1244485):\n  * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff\n- go1.25.13 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`,\n    `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os`\n    packages.\n  * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80393 runtime: `arm64` found pointer to free object with safe code\n  * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80500 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in the\n    write-barrier buffer\n  * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80618 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:\n  * Limit openssl `RandReader` concurrency (#374)\n","status":"published","published":"2026-08-30T14:40:58Z","modified":"2026-08-31T18:15:04.194043468Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21705-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips.\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:\n  (jsc#SLE-18320).\n  * Rebase to 1.26.7\n  * Support `strictfipsruntime` with `no_openssl`\n  * Fix multiple `no_openssl` build tag issues\n- go1.26.7 (released 2026-08-19, boo#1255111):\n  * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff\n- go1.26.6 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,\n    `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the\n    runtime, and the `crypto/tls` and `os` packages.\n  * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared`\n    on Windows)\n  * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80394 runtime: `arm64` found pointer to free object with safe code\n  * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80499 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in\n    the write-barrier buffer\n  * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record\n  * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80619 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:\n  * Limit `openssl` `RandReader` concurrency\n","status":"published","published":"2026-08-30T15:26:45Z","modified":"2026-08-31T18:15:05.235715924Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21761-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:30:23Z","modified":"2026-09-09T18:23:14.573173825Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21983-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.792813938Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22064-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278614).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).\n- Verification bypass via public key in legacy bundle (bsc#1282542).\n\nChanges for cosign:\n\n- update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):\n * This release resolves GHSA-fx35-mq7g-6g98, a verification\n bypass using an unexpected public key in a legacy bundle.\n * Auto-detect default digest algorithm for public keys\n * fix(pkcs11key): return an error instead of panicking when no\n key pair matches\n * Supporting OCI Signing with X.509 Certificate Chain\n * test(inspect): replace mock TSA client usage with local\n timestamp response generator in\n * fix: prevent shell completions for various options not taking\n filenames\n * fix(blob): compare file checksums case-insensitively in\n * Verification bypass via public key in legacy bundle (GHSA-\n fx35-mq7g-6g98)\n","status":"published","published":"2026-10-09T06:33:57Z","modified":"2026-10-19T17:23:11.640294525Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-56864","title":"CVE-2026-56864 in golang.org/x/mod - Patched by Root","description":"Root has patched CVE-2026-56864 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-30T08:07:07Z","modified":"2026-10-30T09:15:37.394372106Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2026:23300-1","title":"Security update for go1.25","description":"This update for go1.25 fixes the following issues:\n\nUpdate to go1.25.13 (released 2026-08-13, bsc#1244485).\n\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,\n  recursive structures (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service\n  (bsc#1275028).\n- CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).\n- CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion\n  and a denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can lead to high\n  memory allocation overhead and a denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service\n  (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating GOPROXY and\n  GOSUMDB to serve a client malicious module content (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input\n  and can lead to malicious module content to be accepted (bsc#1275024).\n\nChanges for go1.25.13:\n\n- go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits\n- go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n- go#80364 os: Root's MkdirAll can't create paths ending in forward slashes\n- go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n- go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n- go#80393 runtime: arm64 found pointer to free object with safe code\n- go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following\n  garbage stack data as a pointer\n- go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n- go#80500 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in the\n  write-barrier buffer\n- go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n- go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n- go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n- go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n- go#80618 cmd/compile: prove bug causes invalid indirect call\n- go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","status":"published","published":"2026-08-19T09:08:20Z","modified":"2026-09-10T18:23:10.439002073Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23301-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go1.26.6 (released 2026-08-13, bsc#1255111).\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,\n  recursive structures (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service\n  (bsc#1275028).\n- CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).\n- CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion\n  and a denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can lead to high\n  memory allocation overhead and a denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service\n  (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating GOPROXY and\n  GOSUMDB to serve a client malicious module content (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input\n  and can lead to malicious module content to be accepted (bsc#1275024).\n\nChanges for go1.26.6:\n\n- go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits\n- go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n- go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on\n  Windows)\n- go#80365 os: Root's MkdirAll can't create paths ending in forward slashes\n- go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n- go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n- go#80394 runtime: arm64 found pointer to free object with safe code\n- go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following\n  garbage stack data as a pointer\n- go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n- go#80499 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in\n  the write-barrier buffer\n- go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n- go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n- go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record\n- go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n- go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n- go#80619 cmd/compile: prove bug causes invalid indirect call\n- go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","status":"published","published":"2026-08-19T09:11:06Z","modified":"2026-09-10T18:23:09.451594508Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23573-1","title":"Security update for go1.25-openssl","description":"This update for go1.25-openssl fixes the following issues:\n\nUpdate to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips:\n  (jsc#SLE-18320):\n  * Rebase to 1.25.14\n- go1.25.14 (released 2026-08-19, boo#1244485):\n  * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff\n- go1.25.13 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`,\n    `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os`\n    packages.\n  * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80393 runtime: `arm64` found pointer to free object with safe code\n  * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80500 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in the\n    write-barrier buffer\n  * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80618 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:\n  * Limit openssl `RandReader` concurrency (#374)\n","status":"published","published":"2026-08-30T14:44:02Z","modified":"2026-09-29T18:23:09.290729763Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23576-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips.\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:\n  (jsc#SLE-18320).\n  * Rebase to 1.26.7\n  * Support `strictfipsruntime` with `no_openssl`\n  * Fix multiple `no_openssl` build tag issues\n- go1.26.7 (released 2026-08-19, boo#1255111):\n  * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff\n- go1.26.6 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,\n    `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the\n    runtime, and the `crypto/tls` and `os` packages.\n  * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared`\n    on Windows)\n  * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80394 runtime: `arm64` found pointer to free object with safe code\n  * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80499 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in\n    the write-barrier buffer\n  * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record\n  * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80619 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:\n  * Limit `openssl` `RandReader` concurrency\n","status":"published","published":"2026-08-30T15:28:34Z","modified":"2026-09-29T18:23:09.593370121Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23625-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:32:03Z","modified":"2026-09-29T18:23:20.110594263Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23973-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:08.92538367Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23984-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:09.062210416Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24213-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278614).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).\n- Verification bypass via public key in legacy bundle (bsc#1282542).\n\nChanges for cosign:\n\n- update to 3.1.3 (bsc#1282542, GHSA-fx35-mq7g-6g98):\n * This release resolves GHSA-fx35-mq7g-6g98, a verification\n bypass using an unexpected public key in a legacy bundle.\n * Auto-detect default digest algorithm for public keys\n * fix(pkcs11key): return an error instead of panicking when no\n key pair matches\n * Supporting OCI Signing with X.509 Certificate Chain\n * test(inspect): replace mock TSA client usage with local\n timestamp response generator in\n * fix: prevent shell completions for various options not taking\n filenames\n * fix(blob): compare file checksums case-insensitively in\n * Verification bypass via public key in legacy bundle (GHSA-\n fx35-mq7g-6g98)\n","status":"published","published":"2026-10-09T06:33:43Z","modified":"2026-10-21T17:23:10.146441225Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n  (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n  provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n  (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n  headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n  configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n  exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283642).\n- CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n  probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n  (bsc#1276514).\n\nChanges for helm:\n\n- update to 4.3.0:\n * feat: Add duration functions\n * feat(engine): add debug logging when lookup returns empty\n * feat: add ownership verification before deleting resources\n * feat: honor SOURCE_DATE_EPOCH for chart archives\n * feat(rollback): add --description flag to provide rollback\n reason\n * fix (internal/plugin): remove zero-width spaces from plugin\n name comment\n * fix(loader): do not drop values files ending at a 4096-byte\n boundary\n * fix(chart): normalize StampModTimes timestamp to UTC/truncate\n + Chart.lock reproducibility test\n * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings\n * fix(template): regression - route registry messages to stderr\n in template and show\n * refactor: lower resync period from one hour to 3 minutes\n * perf: enable concurrent status computation to prevent\n multi-minute delays\n * fix: Improve error reporting for helm template --debug with\n --show-only- #31185\n * fix: fetch logs from all containers in test pods- #32099\n * fix(provenance): check error return in Digest and\n encodeRelease- #32136\n * fix panic on repeated IsReachable calls- #32184\n * fix: set [pull,push] scope when helm push to a registry(use\n token auth) - v4- #31211\n * Fix missing conflict retry with server-side apply- #32088\n * Properly format the extra field in gzipped packages- #31884\n * Fix vanishing empty lines- #32327\n * fix: pass registry client to downloader.Manager in upgrade-\n #32400\n * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1-\n #32450\n * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158-\n #32521\n * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0\n 43e8b7f (Terry Howe)\n * bump golang.org/x/text to v.0.40.0\n * Revert: Fixed a race condition in WaitForDelete where the status\n observer canceled the watch too early, causing intermittent\n failures when running a full test suite #32214\n * Fixed data race detected by -race flag when concurrent\n goroutines (upgrade + rollback, install + uninstall) both call\n GetWaiterWithOptions on the same FailingKubeClient instance\n #31925\n * Fixed helm command success messages writing to stderr instead\n of stdout. Now correctly outputing to stdout #32056\n * Fixed Helm 4 emitting \"unable to find exact version\" when using\n version range constraints #31757\n * Fixed a race condition in WaitForDelete where the status\n failures when running a full test suite #32081\n #32153\n * Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1,\n controller-runtime 0.24.1 and k8s 1.36.1 #32128\n * Dependency updates\n * Bump to version v4.2 0646808 (George Jenkins)\n * build: Clean up Goreleaser change (#32098) e23bf3a (Scott\n Rigby)\n * fix: add -extldflags -static to dist target to match\n build-cross f60ab7c (Terry Howe)\n * build: use goreleaser build with manual archive creation\n 64aa46f (Terry Howe)\n * chore: remove build-cross dependency from test-acceptance\n d199a1a (Terry Howe)\n * ci: add fetch-depth 0 to canary checkout for goreleaser 8289940\n * fix: address goreleaser build issues flagged in review c075022\n (Terry Howe)\n * fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve\n v-prefix in archive names 04885dd (Terry Howe)\n * fix: disable goreleaser checksums.txt and restrict zip to\n windows only 93103ce (Terry Howe)\n * fix: use index for optional env var in version_template e49a1dc\n * fix: canary build file names eaa0910 (Terry Howe)\n * Fix archive name 5a75279 (Terry Howe)\n * fix goreleaser archive 37284a9 (Terry Howe)\n * add support for loong64 45336cc (Terry Howe)\n * fix artifact directory a9659b0 (Terry Howe)\n * update configuration to v2 e368f17 (Terry Howe)\n * remove GOTOOLCHAIN e7bea85 (Terry Howe)\n * chore: replace mitchellh/gox with goreleaser 075c096 (Terry\n Howe)\n * chore(deps): bump github.com/distribution/distribution/v3\n 12f2c41 (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3\n 58e8ffd (dependabot[bot])\n * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0\n to 3.5.0 e61bbfb (dependabot[bot])\n * Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df\n (Matheus Pimenta)\n * fix: adds topLevel permissions to improve openSSF scores\n 277d970 (Gagan H R)\n * Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7\n * fix(templating): hooks conflicting with templates in\n post-renderers (#32049) 8f56f24 (Matheus Pimenta)\n * docs: fix grammar and spacing in CONTRIBUTING.md db40adb\n (Mohit)\n * chore(deps): bump the k8s-io group with 7 updates 775e794\n (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2\n 934ace3 (dependabot[bot])\n * fix(templating): SplitManifests must preserve line endings for\n downstream YAML parsers (#31952) 265c5eb (Matheus Pimenta)\n * chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to\n 1.0.13 48e2b7d (dependabot[bot])\n * Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai)\n * test(values): Add test for nil cleanup in partially overridden\n subchart maps 52fc971 (Johannes Lohmer)\n * fix(values): do not copy chart-default nils into coalesced\n values 0063877 (Johannes Lohmer)\n * test(values): add test for subchart nil producing %!s() 6eb4ebf\n (Johannes Lohmer)\n * test(values): add tests for subchart nil value regressions\n 5cb4e7d (Johannes Lohmer)\n * chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1\n b5c7c80 (dependabot[bot])\n * fix(templating): fix wrong YAML separator parsing for\n post-renderers (#31941) a27f1ad (Matheus Pimenta)\n * fix: add debug logging to HTTP getter for helm pull c26be60\n (Cairon)\n * chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0\n 953f5f0 (dependabot[bot])\n * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0\n 10fc5f3 (dependabot[bot])\n * chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0\n d89e7c6 (dependabot[bot])\n * chore: Update release notes script for Helm v4 8a95461 (George\n Jenkins)\n * refactor(cli): share RetryingRoundTripper via pkg/kubeenv\n 213c869 (Sumit Solanki)\n * chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3\n bd5027a (dependabot[bot])\n * fix: unnecessary-format lint issues from merge 087736b (George\n * fix: Plugin missing provenance bypass 586eb57 (George Jenkins)\n * chore(deps): bump github.com/fluxcd/cli-utils c8c5dfa\n * chore(deps): bump\n go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp\n 998466c (dependabot[bot])\n go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\n b0cec58 (dependabot[bot])\n go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n 6ebfb29 (dependabot[bot])\n * test(kube): fix flaky WaitForDelete test by avoiding informer\n sync race a7f8443 (Terry Howe)\n * test(kube): fix flaky WaitForDelete timing in status wait tests\n 4c0d21f (Terry Howe)\n 08dea9c (dependabot[bot])\n * Minor nit: fix import instructions to comply with canonical\n import paths de58531 (Anmol Virdi)\n 9b1ad4c (dependabot[bot])\n * fix(action): return correct error variable in prepareUpgrade\n 8ef2d45 (Rhys McNeill)\n * chore(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2\n cd7cf76 (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.30.7 to 4.35.1\n 45ee55b (dependabot[bot])\n * chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1\n 9a06741 (dependabot[bot])\n * chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0 d1e31ca\n * fix(kube): clarify server-side apply patch errors f257c95\n (abhay1999)\n workflow 7025480 (Terry Howe)\n * refactor(cli): decouple EnvSettings from pkg/kube 64f1d0a\n (Sumit Solanki)\n * docs(registry): fix incorrect and improve clarity of comments\n in client.go 85bf56e (Debasish Mohanty)\n * refactor(cli): decouple EnvSettings from pkg/kube to avoid\n import cycles 1549937 (Sumit Solanki)\n * chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to\n 1.4.1 c7a75b1 (dependabot[bot])\n * chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0\n 3a7573a (dependabot[bot])\n * chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0\n 0229da1 (dependabot[bot])\n * docs(engine): fix misleading toTOML doc comment c1a5a6e (Ilya\n Kiselev)\n * feat(engine): add mustToToml template function b075f7a (Ilya\n * chore: fix unnecessary-format issues from revive 7edfff3\n (Matthieu MOREL)\n * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3\n 37185d2 (dependabot[bot])\n * chore: fix bool-compare issues from testifylint 071558d\n * chore: enable perfsprint linter 6249489 (Matthieu MOREL)\n * ignore error plugin loads (cli, getter) 47a0840 (George\n * chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0\n 3d06fd1 (dependabot[bot])\n * fix(kube): remove legacy import comments from test files\n e64d628 (Terry Howe)\n * pkg/kube: remove legacy import comments d7cdc9e (abhay1999)\n * fix: Plugin version path traversal 36dcc27 (George Jenkins)\n * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0\n c4be7af (dependabot[bot])\n * chore: fix some minor issues in the comments 259f181 (tsinglua)\n * fix: Chart dot-name path bug 6018499 (George Jenkins)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to\n 0.23.3 74e7cf8 (dependabot[bot])\n * fix: insert newline after doc separators glued to content by\n template trimming af94abf (Matheus Pimenta)\n * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to\n 1.6.3 16073b1 (dependabot[bot])\n * chore: enable modernize linter (#31860) e31a078 (Matthieu\n MOREL)\n * Restored --atomic flag on install command 16573f8 (Travis\n Leeden)\n * fix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for\n GO-2026-4394 b550ce9 (Terry Howe)\n * fix: bump fluxcd/cli-utils to v0.37.2-flux.1 1dfa77e (Terry\n * Update pkg/cmd/status.go 5d40f17 (Matthieu MOREL)\n * chore(internal): enable perfsprint linter (#31871) d4f6193\n * chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0\n 82d9bed (dependabot[bot])\n * chore(pkg): fix perfsprint linter issues part 6 dc0e3f1\n * chore(pkg): enable perfsprint linter e3c74fd (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 1d2d63c (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 63f03c0 (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter c25c988 (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 0fecfd0 (Matthieu MOREL)\n * chore(internal): enable perfsprint linter 6524162 (Matthieu\n * chore(pkg): enable perfsprint linter 6c2cb2f (Matthieu MOREL)\n * chore(internal): enable perfsprint linter 9409226 (Matthieu\n * Replace unneeded use of t.Fatalf with t.Fatal 36cb3a2 (Mads\n Jensen)\n * fix: enable nolinlint linter 5b6c6bb (Matthieu MOREL)\n * fixup strings.Cut variables b667317 (George Jenkins)\n * chore: Improve AGENTS.md 956c724 (George Jenkins)\n * chore: fixes 92b64e8 (George Jenkins)\n * fix: correct import comment in statuswait.go from v3 to v4\n c59c140 (rohansood10)\n * fix: handle OCI digest algorithm prefix in chart downloader\n (#31601) ee01860 (Evans Mungai)\n * chore(deps): bump actions/stale from 10.1.1 to 10.2.0 304d25f\n * chore(deps): bump the k8s-io group with 7 updates 0b13436\n * feat(release): add internal/release/v2 package for chart v3\n support (#31709) 4a91f3a (Evans Mungai)\n 7823853 (dependabot[bot])\n aec7ace (dependabot[bot])\n a23b638 (dependabot[bot])\n 5cddc95 (dependabot[bot])\n * chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.0 to\n 0.21.1 2e266c3 (dependabot[bot])\n * fix(pkg): errorlint linter 259f76a (Matthieu MOREL)\n * fix(internal): errorlint linter 0254182 (Matthieu MOREL)\n * fix(pkg): errorlint linter 6d1490e (Matthieu MOREL)\n * fix(pkg): errorlint linter 4d0ae7f (Matthieu MOREL)\n * fix(internal): errorlint linter abecafa (Matthieu MOREL)\n * fix(pkg): errorlint linter 4330bde (Matthieu MOREL)\n * fix(pkg): errorlint linter c8989d9 (Matthieu MOREL)\n * fix(cmd): errorlint linter edbd705 (Matthieu MOREL)\n * chore: new KEYS entry for George Jenkins 5638c35 (George\n * fix(downloader): safely handle concurrent file writes on\n Windows 76eb37c (Orgad Shaneh)\n * fix(install): check nil for restClientGetter and fix tests\n 9817a68 (Manuel Alonso)\n * feat(create): add --chart-api-version flag (when\n HELM_EXPERIMENTAL_CHART_V3 env var is set) (#31592) 5aac320\n (Evans Mungai)\n * chore(pkg): fix modernize linter 0d75d86 (Matthieu MOREL)\n * chore(internal): fix modernize linter 859292e (Matthieu MOREL)\n * chore(pkg): fix modernize linter 5cc2e55 (Matthieu MOREL)\n * chore(pkg): fix modernize linter ba38159 (Matthieu MOREL)\n * chore(internal): fix modernize linter e2d184c (Matthieu MOREL)\n * chore(pkg): fix modernize linter 111d4e6 (Matthieu MOREL)\n * add image index test e8f386b (Pedro Torres)\n * fix pulling charts from OCI indices d983696 (Pedro Torres)\n 9c9c3a6 (dependabot[bot])\n * Revert \"Consider GroupVersionKind when matching resources\"\n 787b61c (Matheus Pimenta)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to\n 0.23.1 becf9bf (dependabot[bot])\n * fix(template): deprecate unused --hide-notes and\n --render-subchart-notes flags 6d5f56f (Scott Rigby)\n * chore(deps): bump github.com/fluxcd/cli-utils b53198e\n * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 b59e533\n * whitespace ec07265 (Austin Abro)\n * fix(copystructure): handle nil elements in slice copying\n e3829eb (Philipp Born)\n * use logger with waiter 63b40a7 (Austin Abro)\n * feat(kstatus): fine-grained context options for waiting b0b35f1\n * Apply suggestions from code review 26e28e8 (George Jenkins)\n * Remove legacy sync-repo.sh script 97fd007 (Jeevan Yewale)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to\n 0.23.0 5262007 (dependabot[bot])\n * docs: document uninstall using cascade foreground flag e70d59d\n * bugfix(kstatus): do not wait forever on failed resources\n bbec77c (Matheus Pimenta)\n * Modernize Helm v3 CONTRIBUTING.md 443a2a6 (George Jenkins)\n * chore(defaults): server-side apply SDK defaults should always\n match the CLI defaults c1cc625 (Matheus Pimenta)\n * chore: clarify --wait flag help text 828038a (Evans Mungai)\n * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 e223771\n * chore(refactor): better testing and functionality for\n installing crd 6501ef4 (Manuel Alonso)\n * bugfix(storage): fix storage not getting logger from driver\n a8eb527 (Matheus Pimenta)\n da1d68a (dependabot[bot])\n * fix(test): fix tests and check nil for restclient 0f949a9\n (Manuel Alonso)\n * fix(test): merge fix correctly 561410a (Manuel Alonso Gonzalez)\n * Remove refactorring changes from coalesce_test.go 0298b2f\n * Fix import b8937ad (Evans Mungai)\n * Update pkg/chart/common/util/coalesce_test.go a333bba (Evans\n Mungai)\n * Fix rollback for missing resources 374aeb4 (Feruzjon\n Muyassarov)\n * fix(install): add more tests and check nil file data 00f0a48\n * fix(test): no check empty resources 0357e8d (Manuel Alonso)\n * fix(install): check lenght and file nil, add tests 52235cc\n * fix(action): crd resources can be empty 268593b (Manuel Alonso)\n * fix: casing issue fixed 1709114 (Mujib Ahasan)\n * fix: error handled correctly 9486062 (Mujib Ahasan)\n * fix: doc string added 12e8b71 (Mujib Ahasan)\n * Fix lint warning 3416dd5 (Evans Mungai)\n * Preserve nil values in chart already 679f051 (Evans Mungai)\n * fix(values): preserve nil values when chart default is empty\n map 292fe70 (Evans Mungai)\n * update: test coverage added for helper function\n validateNameAndGenerateName 1154099 (Mujib Ahasan)\n * update: helper function added for the business logic 522d2fe\n (Mujib Ahasan)\n * generateName is also considered in logic 6769fb6 (Mujib Ahasan)\n * fxi: test concurrency download index 64bae71 (Terry Howe)\n * update: business logic respected for skipping object missing\n name b357bca (Mujib Ahasan)\n * fixed: --dry-run=server now respect generateName 2820ebe (Mujib\n Ahasan)\n * Make error message instructional for the case of lock file\n being out of date 1836c59 (Andreas Sommer)\n - GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov\n is missing, allowing unsigned plugin install\n - GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version\n enables arbitrary file write outside Helm plugin directory\n - fix: Plugin missing provenance bypass 05fa379 (George\n - fix: Chart dot-name path bug 4e7994d (George Jenkins)\n - ignore error plugin loads (cli, getter) 2581943 (George\n - fix: Plugin version path traversal 36c8539 (George Jenkins)\n scorecards workflow c61e086 (Terry Howe)\n * Fixed a bug where --dry-run=server was not respecting\n generateName #31563\n * Fixed a bug where empty CRD resources caused a crash. Now it\n prints an error #31578\n * Fixed a bug where OCI references with tag+digest failed with\n \"invalid byte\" error #31601\n * Fixed a bug where user-provided nil value was not preserved\n when chart has an empty map or no default for a key #31644\n * Fixed a regression since Helm 3.18.0 where Pulling charts\n from OCI repositories that use an index to store both\n Container Images and Helm Charts under the same tag failed\n #31776\n * Fixed a Helm 4 regression where gotemplate white space\n trimming directly after YAML doc separators, when present\n after postrendering, caused YAML file corruption #31868\n * Fixed a bug where `FailedStatus` is treated as a terminal\n state, causing upgrades to fail prematurely when cluster\n autoscalers needed time to provision nodes, or when pods were\n being deleted during rolling updates #31897\n * Fixed broken backwards compatibility for deprecated\n `--atomic` flag on install command #31901\n * SDK: Fixed a Windows 'Access Deined' error if multiple\n processes try to download the same chart version concurrently\n #31128\n * SDK: Fixed a bug where users did not receive any logs from\n the waiter, causing confusion as several minutes could pass\n with no user feedback #31717\n * SDK: Fixed a bug where server-side apply defaults did not\n always match the CLI defaults #31732\n * SDK: Fixed a Go import issue when downstream tooling\n attempted to vendor helm.sh/helm/v4/pkg/kube #31852\n - Fixed a bug where --dry-run=server was not respecting\n - Fixed a bug where empty CRD resources caused a crash. Now it\n - Fixed a bug where OCI references with tag+digest failed with\n - Fixed a bug where user-provided nil value was not preserved\n - Fixed a regression since Helm 3.18.0 where Pulling charts\n - Fixed a Helm 4 regression where gotemplate white space\n - Fixed a bug where FailedStatus is treated as a terminal\n - Fixed broken backwards compatibility for deprecated --atomic\n flag on install command #31901\n - SDK: Fixed a Windows 'Access Deined' error if multiple\n - SDK: Fixed a bug where users did not receive any logs from\n - SDK: Fixed a bug where server-side apply defaults did not\n - SDK: Fixed a Go import issue when downstream tooling\n- Update to version 4.1.1:\n - fix: fine-grained context options for waiting #31735\n - fix: kstatus do not wait forever on failed resources #31730\n - fix: Revert \"Consider GroupVersionKind when matching\n resources\" #31772\n - fix: handle nil elements in slice copying #31751\n - Feature: added chart name to dependency logs, namespace to\n resource waiting logs, and confirmation message when all\n resources are ready #31530\n - Feature: improved plugin name validation error messages and\n field name detection #31491\n - Feature: improved the --wait flag by allowing explicit\n strategy selection (including explicit --wait=hookOnly) and\n preventing SDK timeout errors when timeout is not specified\n #31421\n - Feature: allow concurrent dependency build with atomic file\n write #30984\n - Feature: added a --no-headers flag to the 'helm repo list'\n command, allowing users to suppress table headers in the\n output. Useful for scripting and automation #31448\n - SDK feature: added a LoadArchive to common loader #31462\n - SDK feature: introduced support for custom kstatus readers\n #31706\n - Fixed bug where a plugin name could already be used by\n another command #31427\n - Fixed bug where --server-side flag was not passed to install\n when using upgrade --install #31635\n - Fixed bug where HELM_ environment variables were not passed\n to plugins. this fixes a regression which was blocking some\n getter plugins #31613\n - Fixed bug where Helm test --logs failed with\n hook-delete-policy \"hook-failed\" or \"hook-succeed\" #31579\n - Fixed kube client logging issue #31560\n - Fixed regression where vendor-specific suffixes were stripped\n from .Capabilities.KubeVersion.GitVersion, breaking charts\n that detect managed Kubernetes platforms #31528\n - Fixed a bug where helm uninstall with --keep-history did not\n suspend previous deployed releases #12564\n - docs: updated helm template help text to document\n --api-versions #31683\n - docs: fixed documentation about default wait strategy\n - Update pkg/kube/statuswait.go\n - pkg/kube: introduce support for custom kstatus readers\n - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0\n - fix(release): fix test compilation error\n - Suppress SC2154 without changing behavior\n - Lint sync-repo.sh with ShellCheck\n - chore: move Evans Mungai from triage to maintainers\n - Replace reflect.Ptr with reflect.Pointer\n - fix: typo in the function names\n - Add documentation for --api-versions flag in template command\n - Fixing failing tests for cli-tools update\n - chore(deps): bump github.com/fluxcd/cli-utils\n - Replace deprecated `NewSimpleClientset`\n - docs(README): add mise alternate installation documentation\n - enable exhaustive linter\n - fix: add default casess to switch statements\n - build: set kube version via `debug.BuildInfo`\n - chore(deps): bump github.com/tetratelabs/wazero from 1.10.1\n to 1.11.0\n - doc: update based on review suggestion\n - test(statuswait): fix Copilot code review suggestion for\n goroutine in tests\n - test(statuswait): add more tests suggested by Copilot code\n review\n - test(statuswait): add some tests for statuswait\n - fix: use namespace-scoped watching to avoid cluster-wide LIST\n permissions\n - fix(doc): Update default wait strategy\n - Update to use slog\n - Fix TestCliPluginExitCode\n - Check plugin name is not used\n - Fix `TestConcurrencyDownloadIndex` typo\n - Use errors.Is to check for io.EOF and gzip.ErrHeader\n - chore(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0\n - chore: fix some comments to improve readability\n - feat: move TerryHowe triage to maintainers\n - Use latest patch release of Go in releases\n - fix(upgrade): pass --server-side flag to install when using\n upgrade --install\n - chore(deps): bump github.com/spf13/cobra from 1.10.1 to\n 1.10.2\n - chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0\n - Run the vulnerability check on PR that change the file\n - Fix govulncheck in CI\n - Update the govulncheck.yml to run on change\n - Enable the sloglint linter\n - fix(cli): handle nil config in EnvSettings.Namespace()\n - fix(getter): pass settings environment variables\n - fixes comment in install.go\n - chore(deps): bump actions/stale from 10.1.0 to 10.1.1\n - chore(deps): bump golangci/golangci-lint-action from 9.1.0 to\n 9.2.0\n - fixes tests after merge\n - fixes lint issue\n - updates tests after rebase from master\n - Add tests to action package to improve coverage\n - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1\n - Inform we use a different golangci-lint version than the CI\n - Deal with golint warning with private executeShutdownFunc\n - Use length check for MetaDependencies instead of nil\n comparison\n - Code review\n - Fix linting issue\n - Update pkg/action/hooks.go\n - added check for nil shutdown\n - cleaned up empty line\n - updated comment and made defer of shutdown function return\n errors as before and not the possible shutdown error\n - added shutdown hook that is executed after the logs have been\n retrieved\n - chore: fix typo in pkg/downloader/chart_downloader.go\n - Bump required go version (`go.mod` version)\n - Use modernize to use newer Golang features.\n - Remove two redundant if-checks.\n - Fix kube client logging\n - chore(deps): bump golangci/golangci-lint-action from 9.0.0 to\n 9.1.0\n - chore(deps): bump actions/checkout from 5.0.1 to 6.0.0\n - chore(deps): bump actions/setup-go from 5.5.0 to 6.1.0\n - fix: prevent segmentation violation on empty yaml in multidoc\n - fix: prevent reporting fallback on version when none\n specified\n - fix: add missing context to debug logs\n - fix: preserve vendor suffixes in KubeVersion.GitVersion\n - chore(deps): bump actions/checkout from 5.0.0 to 5.0.1\n - fixup test\n - logs\n - fix\n - chore: add warning for registry login with namespace\n - style: linting\n - test: split tests between valid and invalid\n - test: convert tests to table drive tests\n - test: refactor TestMetadataLegacyValidate to be more generic\n - update tests\n - fix: Use server-side apply for object create during update\n - Copy adopted resource info\n - Refactor environment variable expansion in PrepareCommands\n and update tests\n - fix: correct LDFLAGS path for default Kubernetes version\n - fix: improve plugin name validation err messages early via\n unmarshalling\n - fix: Make invalid name error message more similar and move\n tests\n - fix: focus only on plugin name but give more info about what\n we get\n - Make validation error similar and explicit for both metadatas\n - fix: improve plugin name validation error messages\n - Fix syntax errors in the document\n - docs: Fix LFX Health Score badge URL in README.md\n - chore(deps): bump github.com/tetratelabs/wazero from 1.9.0 to\n 1.10.1\n - Publish Helm v4 -\u003e `helm-latest-version`\n - Adding script to download Helm v4\n - refactor: use strings.Builder to improve performance\n - chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.20.1 to\n 0.21.0\n - chore(deps): bump golangci/golangci-lint-action from 8.0.0 to\n 9.0.0\n - Update pkg/cmd/flags.go\n - Error strategy list match help\n - Prevent surprising failure with SDK when timeout is not set\n - Do not change the default waiting strategy when --wait is not\n set\n - Provide more help for SDK user when setting up WaitStrategy\n - Avoid confusion between `--wait` (watcher) and no --wait\n (hookOnly)\n - The default is not HookOnlyStrategy but WaitStrategy\n - Make wait strategy selection more obvious\n - Increase documentation of --wait flag\n - While testing SDK features for v4. I was surprised with the\n error:\n - fix: do not run release workflow on forks\n - Convert pkg/cmd/load_plugins.go to slog\n - Rename copilot-instructions.md to AGENTS.md\n - fix(rollback): `errors.Is` instead of string comp\n - fix(uninstall): supersede deployed releases\n - for remaining local variable case inconsistency\n - Properly test error messages on pull command's test\n - Adding a LoadArchive to common loader\n - for all other similar cases\n - chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.3\n to 0.22.4\n - chore: increase logging package test coverage\n - feat(repo): add --no-headers option to 'helm repo list'\n - chore: fix typo of public field\n - rename interface{} to any\n - test: protect unknown hook delete policies\n - chore: replace github.com/mitchellh/copystructure\n - fix: Fix Helm v4 release distribtion/get-helm-3 script\n - fix test\n - Make test scripts run without /bin/bash\n - Ignore duplicated URN in logs\n - chore: delete unused var in installer.go\n - fix: assign KUBECONFIG environment variable value to\n env.Kubeconfig\n - add concurrency test on write \u0026 load index file\n - update writing index files to writeAtomicFile\n - fix index concurrency\n- Update to version 4.0.5:\n - Fixed rollback error when a manifest is removed in a failed\n upgrade #13437\n - Fixed check to ensure CLI plugin does not load with the same\n name as an existing Helm command\n - Fixed helm test --logs failure with hook-delete-policy\n \"hook-failed\" or \"hook-succeed\" #9098\n - Fixed a bug where empty dependency lists were incorrectly\n treated as present\n - Fixed a bug where the watch library did not only watch\n namespaces associated with the objects\n - Fixed regression in downloader plugins environment variables\n #31612\n - Fixed bug where --server-side flag is not respected with helm\n upgrade --install #31627\n - For SDK users: exposed KUBECONFIG to env\n upgrade --install 1b6053d (Evans Mungai)\n 1e3ee1d (Zadkiel AHARONIAN)\n - fix(getter): pass settings environment variables 31bd995\n (Zadkiel AHARONIAN)\n goroutine in tests 41a6b36 (Mohsen Mottaghi)\n review 2a2e6f7 (Mohsen Mottaghi)\n - test(statuswait): add some tests for statuswait 3818c02\n (Mohsen Mottaghi)\n permissions 66cab24 (Mohsen Mottaghi)\n comparison abf2007 (Calvin Bui)\n 4b3de18 (Benoit Tigeot)\n - Code review 3212770 (Benoit Tigeot)\n - Fix linting issue 417aae9 (Benoit Tigeot)\n - Update pkg/action/hooks.go 6c838b4 (Michelle Fernandez\n Bieber)\n - added check for nil shutdown c5d87f2 (Michelle Fernandez\n - cleaned up empty line 53175b7 (Michelle Fernandez Bieber)\n errors as before and not the possible shutdown error d2df1ab\n (Michelle Fernandez Bieber)\n retrieved 5b223de (Michelle Fernandez Bieber)\n - Fix TestCliPluginExitCode e845b68 (tison)\n - Check plugin name is not used 30bfd57 (tison)\n - Fix rollback for missing resources 0fd2c41 (Feruzjon\n env.Kubeconfig b456e27 (LinPr)\n - fix(rollback): errors.Is instead of string comp e2021f8\n - fix(uninstall): supersede deployed releases af7c153 (Hidde\n- Update to version 4.0.4 (4.0.3 was not released):\n * Bump v4.0.2 CVE deps cd700e0 (George Jenkins)\n * Use latest patch release of Go in releases 9db13ee (Matt\n- Update to version 4.0.2:\n * fix: prevent reporting fallback on version when none specified\n * fix: prevent segmentation violation on empty yaml in multidoc\n * Ignore duplicated URN in logs\n * jsonschema: warn and ignore unresolved URN $ref to match\n v3.18.4\n * Publish Helm v4 -\u003e `helm-latest-version`\n * fix: Fix Helm v4 release distribtion/get-helm-3 script\n * Copy adopted resource info 12500dd (George Jenkins)\n * fixup test 1cf3841 (George Jenkins)\n * logs 32e2d08 (George Jenkins)\n * fix 4b6472f (George Jenkins)\n * fix: Use server-side apply for object create during update\n 9dfe3b3 (George Jenkins)\n * Fix kube client logging 861adc2 (Matt Farina)\n * update tests b2f7872 (yxxhero)\n * Refactor environment variable expansion in PrepareCommands and\n update tests 77f97a1 (yxxhero)\n * Fix syntax errors in the document a156195 (Fish-pro)\n * fix: correct LDFLAGS path for default Kubernetes version\n 2c0dcda (Benoit Tigeot)\n * New Features\n Helm 4 has numerous new features, but a few deserve\n highlighting here:\n - Redesigned plugin system that supports Web Assembly based\n plugins\n - Post-renderers are now plugins\n - Server side apply is now supported\n - Improved resource watching, to support waiting, based on\n kstatus\n - Local Content-based caching (e.g. for charts)\n - Logging via slog enabling SDK logging to integrate with\n modern loggers\n - Reproducible builds of chart archives\n - Updated SDK API including support for multiple chart API\n versions (new experimental v3 chart API version coming soon)\n * Compatibility with Helm v3\n Helm v4 is a major version with backward incompatible changes\n including to the flags and output of the Helm CLI and to the\n SDK.\n Please evaluate the changes to your workflows. The changes are\n not as extensive as those from Helm v2 to v3, with the goal\n that the majority of workflows remain compatible between Helm\n v3 and v4.\n Helm charts apiVersion v2 (majority of today's charts) will\n continue to be supported in Helm v4. Existing charts should\n continue to install, upgrade, and otherwise work. Please test\n the installation and upgrade of charts to ensure it works as\n expected. Changes (e.g., server side apply) may impact the\n experience.\n * Breaking Changes\n - Post-renderers implemented as plugins\n Post-renderers are implemented as plugins. With this change,\n it is no longer possible to pass an executable directly to\n helm render --post-renderer, but a plugin name must be\n passed. This might require updates to existing any\n post-renderer workflows.\n","status":"published","published":"2026-10-19T09:48:48Z","modified":"2026-10-27T17:23:10.85597584Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:3640-1","title":"Security update for go1.25","description":"This update for go1.25 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).\n- CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).\n- CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).\n- CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).\n- CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n\nNon security issue fixed:\n\n- go1.25 release tracking (bsc#1244485).\n\nChanges for go1.25:\n\n- update to go1.25.13\n * go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits\n * go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n * go#80364 os: Root's MkdirAll can't create paths ending in forward slashes\n * go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n * go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n * go#80393 runtime: arm64 found pointer to free object with safe code\n * go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer\n * go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer\n * go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n * go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n * go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n * go#80618 cmd/compile: prove bug causes invalid indirect call\n * go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","status":"published","published":"2026-08-18T09:05:33Z","modified":"2026-08-18T17:30:04.203009344Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3641-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).\n- CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).\n- CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).\n- CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).\n- CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n\nNon security issue fixed:\n\n- go1.26 release tracking (bsc#1255111).\n\nChanges for go1.26:\n\n- update to go1.26.6\n * go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits\n * go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n * go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)\n * go#80365 os: Root's MkdirAll can't create paths ending in forward slashes\n * go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n * go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n * go#80394 runtime: arm64 found pointer to free object with safe code\n * go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer\n * go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer\n * go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record\n * go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n * go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n * go#80619 cmd/compile: prove bug causes invalid indirect call\n * go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","status":"published","published":"2026-08-18T09:06:51Z","modified":"2026-08-18T17:30:04.154129882Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3799-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.\n  \nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:\n  (jsc#SLE-18320).\n  * Rebase to 1.26.7\n  * Support `strictfipsruntime` with `no_openssl`\n  * Fix multiple `no_openssl` build tag issues\n- go1.26.7 (released 2026-08-19, boo#1255111):\n  * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff\n- go1.26.6 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,\n    `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the\n    runtime, and the `crypto/tls` and `os` packages.\n  * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared`\n    on Windows)\n  * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80394 runtime: `arm64` found pointer to free object with safe code\n  * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in\n    the write-barrier buffer\n  * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record\n  * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80619 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:\n  * Limit `openssl` `RandReader` concurrency\n","status":"published","published":"2026-08-25T12:45:13Z","modified":"2026-08-27T11:01:49.758446371Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3800-1","title":"Security update for go1.25-openssl","description":"This update for go1.25-openssl fixes the following issues:\n\nUpdate to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips:\n  (jsc#SLE-18320):\n  * Rebase to 1.25.14\n- go1.25.14 (released 2026-08-19, boo#1244485):\n  * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff\n- go1.25.13 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`,\n    `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os`\n    packages.\n  * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80393 runtime: `arm64` found pointer to free object with safe code\n  * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the\n    write-barrier buffer\n  * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80618 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:\n  * Limit openssl `RandReader` concurrency (#374)\n","status":"published","published":"2026-08-25T12:46:32Z","modified":"2026-08-27T11:01:49.755678272Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3815-1","title":"Security update for go1.25-openssl","description":"This update for go1.25-openssl fixes the following issues:\n\nUpdate to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips:\n  (jsc#SLE-18320):\n  * Rebase to 1.25.14\n- go1.25.14 (released 2026-08-19, boo#1244485):\n  * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff\n- go1.25.13 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`,\n    `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os`\n    packages.\n  * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80393 runtime: `arm64` found pointer to free object with safe code\n  * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the\n    write-barrier buffer\n  * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80618 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:\n  * Limit openssl `RandReader` concurrency (#374)\n","status":"published","published":"2026-08-26T11:02:14Z","modified":"2026-08-31T18:23:11.030212827Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3816-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.\n  \nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial\n  of service (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support\n  unencrypted HTTP/2 allows for denial of service (bsc#1275028).\n- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS\n  (bsc#1275033).\n- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can\n  lead to denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to\n  denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to\n  a denial of service (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained\n  within the transparency log (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of\n  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).\n\nOther updates and bugfixes:\n\n- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:\n  (jsc#SLE-18320).\n  * Rebase to 1.26.7\n  * Support `strictfipsruntime` with `no_openssl`\n  * Fix multiple `no_openssl` build tag issues\n- go1.26.7 (released 2026-08-19, boo#1255111):\n  * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff\n- go1.26.6 (released 2026-08-13):\n  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,\n    `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the\n    runtime, and the `crypto/tls` and `os` packages.\n  * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits\n  * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`\n  * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared`\n    on Windows)\n  * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes\n  * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880\n  * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880\n  * go#80394 runtime: `arm64` found pointer to free object with safe code\n  * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following\n    garbage stack data as a pointer\n  * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field\n  * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in\n    the write-barrier buffer\n  * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of\n    spills\n  * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n  * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record\n  * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic\n  * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames\n  * go#80619 cmd/compile: `prove` bug causes invalid indirect call\n  * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load\n- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:\n  * Limit `openssl` `RandReader` concurrency\n","status":"published","published":"2026-08-26T11:02:43Z","modified":"2026-08-31T18:23:11.027910962Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3830-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\n- go1.27.0 (released 2026-08-19) is a major release of Go.\n  go1.27.x minor releases will be provided through August 2027.\n  https://github.com/golang/go/wiki/Go-Release-Cycle\n  go1.27 arrives six months after Go 1.26. Most of its changes are\n  in the implementation of the toolchain, runtime, and\n  libraries. As always, the release maintains the Go 1 promise of\n  compatibility. We expect almost all Go programs to continue to\n  compile and run as before. (bsc#1272545)\n\n  * Language change: Go 1.27 now supports generic methods: a method\n    declaration may declare its own type parameters. This widely\n    anticipated change allows adding generic functions within the\n    namespace of a particular data type where before one had to\n    declare such functions with a scope of the entire package.\n  * Language change: A key in a struct literal may now be any valid\n    field selector for the struct type, not just a (top-level)\n    field name of the struct.\n  * Language change: Function type inference has been generalized\n    to apply in all contexts where a generic function is assigned\n    to a variable of (or converted to) a matching function type.\n  * Tools: Response file (@file) parsing is now supported for the\n    compile, link, asm, cgo, cover, and pack tools. The response\n    file contains whitespace-separated arguments with support for\n    single-quoted and double-quoted strings, escape sequences, and\n    backslash-newline line continuation. The format is compatible\n    with GCC’s response file implementation to ensure\n    interoperability with existing build systems.\n  * go command: The go command no longer has support for the bzr\n    version control system. It will no longer be able to directly\n    fetch modules hosted on bzr servers.\n  * godebug: Starting with Go 1.27, the go command now recognizes a\n    GODEBUG setting for which support was removed (such as\n    asynctimerchan, see below) if it appears in go.mod files\n    (godebug entries) and .go source files (//go:debug\n    comments). It accepts these settings if they are set to the\n    final default value established before the setting was\n    removed. If they are set to an old value, the go command will\n    fail. This change is in the spirit of the Go 1 compatibility\n    guarantee and allows existing programs that set supported\n    GODEBUG settings to continue to build and run without changes\n    even when the respective setting support has been removed.\n  * go test: go test now invokes the stdversion vet check by\n    default. This reports the use of standard library symbols that\n    are too new for the Go version in force in the referring file,\n    as determined by go directive in go.mod and build tags on the\n    file.\n  * go test: go test -json now annotates 'Action':'output' lines\n    with an optional new field 'OutputType', specifying the type of\n    output. Currently, the possible values include “error”,\n    “error-continue”, and “frame”. See cmd/test2json help for\n    details.\n  * go doc: The go doc command now supports package@version syntax,\n    such as go doc example.com/pkg@v1.2.3.\n  * go doc: The go doc command now accepts the -ex command-line\n    option to list executable examples of the given package or\n    symbol. When an example name is passed on the command line\n    (such as go doc bytes.ExampleBuffer), go doc now prints the\n    example source code along with comments.\n  * go fix: The go fix command contains several new modernizers\n    (atomictypes, embedlit, slicesbackward, and unsafefuncs).\n  * go fix: The existing fmtappendf analyzer was removed due to\n    stylistic concerns.\n  * go fix: The existing waitgroup analyzer was renamed to\n    waitgroupgo to avoid ambiguity.\n  * go mod tidy: For modules specifying go 1.27 or later in their\n    go.mod file, go mod tidy now automatically merges duplicate\n    require blocks. This ensures the file maintains a clean,\n    standard structure containing at most two require blocks: one\n    for direct dependencies and one for indirect dependencies.\n  * go mod fix: Existing comment blocks attached to dependencies\n    are preserved during this consolidation. If a comment block is\n    associated with a mixed set of directives (containing both\n    direct and indirect dependencies), the comment block is merged\n    and attached to the new direct dependency block.\n  * go mod fix: Previously, if a go.mod file accumulated multiple\n    disjoint require blocks (often due to manual edits, unresolved\n    Git merge conflicts, or legacy upgrades) go mod tidy would\n    leave the extra blocks intact or inadvertently create new\n    ones. The tool now strictly enforces the two-block layout,\n    consolidating disparate requirements into their respective\n    blocks and cleaning up the structure of the module file\n    automatically.\n  * go tool trace: go tool trace’s -http command-line option now\n    restricts the listen address to localhost when passed only a\n    port (e.g., -http=:6060). This change makes go tool trace\n    consistent with the behavior of go tool pprof’s -http flag. To\n    listen on all addresses, explicitly include the specified\n    address (e.g., -http=0.0.0.0:6060).\n  * runtime: Tracebacks for modules with go directives configuring\n    Go 1.27 or later will now include runtime/pprof goroutine\n    labels in the header line. This behavior can be disabled with\n    tracebacklabels=0 GODEBUG setting (added in Go 1.26). This\n    opt-out is expected to be kept indefinitely in case goroutine\n    labels acquire sensitive information that shouldn’t be made\n    available in tracebacks.\n  * runtime: The asynctimerchan GODEBUG setting (added in Go 1.23)\n    has been removed permanently. Channels created by package time\n    are now always unbuffered (synchronous), irrespective of\n    GODEBUG settings.\n  * runtime: Faster memory allocation. The compiler now generates\n    calls to size-specialized memory allocation routines, reducing\n    the cost of some small (\u003c80 byte) memory allocations by up to\n    30%. Improvements vary depending on the workload, but the\n    overall improvement is expected to be ~1% in real\n    allocation-heavy programs. This causes the binary size to\n    increase by about 60 KB (independent of the workload). Please\n    file an issue if you notice any regressions. You may set\n    GOEXPERIMENT=nosizespecializedmalloc at build time to disable\n    it. This opt-out setting is expected to be removed in Go 1.28.\n  * runtime: Goroutine leak profile. A new profile type that\n    reports leaked goroutines, previously available as an\n    experiment in Go 1.26, is now generally available. The new\n    profile type, named goroutineleak, is supported in the\n    runtime/pprof package. It is also available as the\n    net/http/pprof endpoint /debug/pprof/goroutineleak. A leaked\n    goroutine is a goroutine blocked on some concurrency primitive\n    (channels, sync.Mutex, sync.Cond, etc) that cannot possibly\n    become unblocked. The runtime detects leaked goroutines using\n    the garbage collector: if a goroutine G is blocked on\n    concurrency primitive P, and P is unreachable from any runnable\n    goroutine or any goroutine that those could unblock, then P\n    cannot be unblocked, so goroutine G can never wake up. While it\n    is impossible to detect permanently blocked goroutines in all\n    cases, this approach detects a large class of such\n    leaks. Because this technique builds on reachability, the\n    runtime may fail to identify leaks caused by blocking on\n    concurrency primitives reachable through global variables or\n    the local variables of runnable goroutines. Special thanks to\n    Vlad Saioc at Uber for contributing this work. The\n    goroutineleakprofile GOEXPERIMENT setting is now deleted.\n  * compiler: The compiler now resolves a relative filename in a\n    //line or /*line*/ directive against the directory of the file\n    containing the directive, matching the behavior of\n    go/scanner. Absolute filenames are unaffected. See #70478.\n  * compiler: The compiler now generates simpler names for function\n    literals (closures). Previously, when the containing function\n    is inlined, the function literal’s name can get quite long. Now\n    the compiler chooses the same name for the function literal\n    regardless of inlining. It may also combine multiple instances\n    of the same function literal (as its containing function is\n    inlined) to share the same code in the compiled binary. This\n    change does not affect the functionality of Go code. Tests that\n    check symbol names may need update, although it is recommended\n    to not depend on the names of function literals. For programs\n    that incorrectly compare function code pointer for equality,\n    the issue may be more exposed with Go 1.27, as function\n    literals with different captured closure data may have equal\n    code pointers in more cases.\n  * linker: When targeting macOS, the linker now accepts -macos and\n    -macsdk command-line options, which specify the OS and SDK\n    versions in the LC_BUILD_VERSION load command. By default, it\n    selects the oldest supported macOS version (currently 13.0.0)\n    and a recent SDK version (currently 26.2.0).\n  * Standard library: New encoding/json/v2 and\n    encoding/json/jsontext packages\n  * Standard library: The encoding/json/v2 package is a major\n    revision of encoding/json. It provides Marshal, MarshalWrite,\n    MarshalEncode, Unmarshal, UnmarshalRead, and UnmarshalDecode,\n    all of which accept variadic Options arguments to configure\n    marshaling and unmarshaling behavior. The v2 package chooses\n    stricter, more interoperable defaults than v1: it rejects\n    invalid UTF-8 in JSON strings and rejects duplicate names\n    within a JSON object. See the v1 encoding/json package\n    documentation for the complete set of behavioral differences\n    and the options available to adjust them. Marshal performance\n    is broadly at parity with the previous implementation, while\n    unmarshal performance is significantly faster. Users who\n    encounter compatibility problems with the new implementation\n    may disable it by setting GOEXPERIMENT=nojsonv2 at build time,\n    restoring the original v1 implementation. This opt-out is\n    expected to be removed in a future release.\n  * Standard library: The encoding/json/jsontext package provides\n    lower-level syntactic processing of JSON. The Encoder and\n    Decoder types operate on JSON as a sequence of Token and Value,\n    maintaining a state machine to ensure the produced or consumed\n    sequence is valid JSON text. The encoding/json package is now\n    backed by the v2 implementation. Marshaling and unmarshaling\n    behavior is preserved, but the exact text of error messages may\n    differ. The package also gains a number of new Options that can\n    configure v2 to operate with v1 semantics to avoid requiring a\n    full migration to the new API. The v1 API will continue to be\n    supported and users are not required to migrate. Marshal\n    performance is broadly at parity with the previous\n    implementation, while unmarshal performance is significantly\n    faster.\n  * crypto: The new crypto/mldsa package implements the\n    post-quantum ML-DSA signature scheme specified in FIPS 204.\n  * crypto: crypto/x509 now supports ML-DSA private keys,\n    public keys, and signatures.\n  * crypto: crypto/tls now supports ML-DSA signatures in\n    TLS 1.3, with the new MLDSA44, MLDSA65, and MLDSA87\n    SignatureScheme values.\n  * uuid: The new uuid package generates and parses UUIDs.\n  * simd (experimental): New experimental simd package. Go 1.27\n    introduces a new experimental simd package that provides\n    portable and vector-size-agnostic SIMD support. It will make\n    use of the hardware instructions if they are available. This\n    package is enabled by setting the environment variable\n    GOEXPERIMENT=simd at build time. The simd package is available\n    on all architectures, and provides vector types of unspecified\n    size such as Int8s and Float32s. It supports a “scalable”\n    subset of the operations present in the simd/archsimd package\n    that are hardware-supported or easily emulated across\n    architectures and vector widths.\n  * simd/archsimd (experimental): Go 1.27 continues the\n    experimental support for SIMD operations in the simd/archsimd\n    package that began in Go 1.26. This release revises the amd64\n    API and adds support for arm64 “Neon” 128-bit SIMD and\n    WebAssembly 128-bit SIMD. The simd/archsimd package is enabled\n    by setting the environment variable GOEXPERIMENT=simd at build\n    time. This package provides access to architecture-specific\n    SIMD operations. It supports 128-bit vector types on wasm,\n    arm64, and amd64, and 256-bit and 512-bit vector types on some\n    amd64 processors. The API is not yet considered stable. We\n    intend to provide support for additional architectures in\n    future versions, but the API is intentionally\n    architecture-specific and thus non-portable.\n  * bytes: The new CutLast function slices a []byte around the last\n    occurrence of a separator. It can replace and simplify some\n    common uses of LastIndex.\n  * compress/flate: Compression speed is improved in Go 1.27. The\n    exact encoded output from Writer may be different from Go 1.26\n    as a result of the encoder implementation change. Since DEFLATE\n    is the underlying compression used in archive/zip,\n    compress/gzip, compress/zlib, and image/png, the outputs from\n    those packages may also have changed.\n  * crypto: The new MLDSAMu Hash value is added for use as a\n    signaling mechanism for External mu ML-DSA signing.\n  * crypto/ecdsa: PrivateKey.Sign now checks that the length of the\n    hash is correct, if a non-nil SignerOpts is provided.\n  * crypto/tls: The new QUICConfig.ClientHelloInfoConn field\n    specifies the net.Conn to use for the ClientHelloInfo.Conn\n    field during QUIC server handshakes.\n  * crypto/tls: The MLKEM1024 key exchange is now supported. It can\n    be enabled by adding it to Config.CurvePreferences.\n  * crypto/tls: Config.Rand is now deprecated. For deterministic\n    testing, use testing/cryptotest.SetGlobalRandom.\n  * crypto/tls: Post-quantum hybrid key exchanges can now be\n    explicitly enabled in Config.CurvePreferences even if the\n    tlsmlkem=0 or tlssecpmlkem=0 GODEBUG options are used. Those\n    options were always meant to only apply to the default set used\n    when Config.CurvePreferences is nil.\n  * crypto/tls: The new ConnectionState.LocalCertificate field\n    contains the certificate chain presented to the connection peer\n    during the handshake.\n  * crypto/tls: The tlsunsafeekm (added in Go 1.22), tlsrsakex\n    (added in Go 1.22), tls3des (added in Go 1.23), tls10server\n    (added in Go 1.22), and x509keypairleaf (added in Go 1.23)\n    GODEBUG settings have been removed permanently.\n  * crypto/x509: When parsing into pkix.Name fields, a wider range\n    of pkix.AttributeTypeAndValue.Value types is now supported, and\n    unknown types are parsed into asn1.RawValue.\n  * crypto/x509: The new Certificate.RawSignatureAlgorithm,\n    CertificateRequest.RawSignatureAlgorithm, and\n    RevocationList.RawSignatureAlgorithm fields expose the\n    DER-encoded AlgorithmIdentifier of the signature algorithm,\n    including when the SignatureAlgorithm field is\n    UnknownSignatureAlgorithm.\n  * crypto/x509: SystemCertPool now respects SSL_CERT_FILE and\n    SSL_CERT_DIR on Windows and Darwin. When these environment\n    variables are set, roots are loaded from disk and instead of\n    using the platform certificate verification APIs, the native Go\n    verifier is used. This behavior can be disabled with\n    GODEBUG=x509sslcertoverrideplatform=0.\n  * crypto/x509/pkix: RDNSequence.String (and therefore\n    Name.String) now renders string-typed attribute values as\n    strings even when the attribute’s OID is\n    unrecognized. Previously such values were always hex-encoded in\n    their DER form. See #33093.\n  * database/sql: The new ConvertAssign function gives database\n    drivers access to the type conversions performed by Rows.Scan.\n  * database/sql/driver: Drivers may implement the new\n    RowsColumnScanner interface to scan directly into user-provided\n    destinations.\n  * go/constant: The new StringLen function returns the length of a\n    string Value without fully constructing the Value.\n  * go/scanner: The scanner now allows retrieving the end position\n    of a token via the new Scanner.End method.\n  * go/token: File now has a String method.\n  * go/types: The Hasher type is an implementation of\n    maphash.Hasher for Types that respects the Identical\n    equivalence relation, allowing Types to be used in hash tables\n    and similar data structures. HasherIgnoreTags is the analogous\n    hasher for IdenticalIgnoreTags.\n  * go/types: The gotypesalias GODEBUG setting (added in Go 1.22)\n    has been removed permanently and the package go/types now\n    always produces an Alias type node for alias declarations\n    irrespective of GODEBUG settings.\n  * hash/maphash: The Hasher interface type defines the contract\n    between values of a particular type and future hash-based data\n    structures such as hash tables and Bloom filters; see #70471.\n  * hash/maphash: The ComparableHasher type provides a convenient\n    implementation of Hasher for comparable types where the Equal\n    method is defined as ==.\n  * math/big: Int now has a Divide method to compute quotient and\n    remainder of two Int values. It supports rounding modes Trunc,\n    Floor, Round, and Ceil.\n  * math/rand/v2: Rand now supports a generic method N, matching\n    the behavior of the top-level N function.\n  * net: UnixConn read methods now return io.EOF directly instead\n    of wrapping it in net.OpError when the underlying read returns\n    EOF.\n  * net/http: Transport and Server support TLS ALPN protocol\n    negotiation on user-provided net.Conn connections which\n    implement a ConnectionState() tls.ConnectionState method.\n  * net/http: HTTP/2 server now accepts client priority signals, as\n    defined in RFC 9218, allowing it to prioritize serving HTTP/2\n    streams with higher priority. If the old behavior is preferred,\n    where streams are served in a round-robin manner regardless of\n    priority, Server.DisableClientPriority can be set to true.\n  * net/http: HTTP/1 Response.Body now automatically drains any\n    unread content upon being closed, up to a conservative limit,\n    to allow better connection reuse. For most programs, this\n    change should be a no-op, or result in a performance\n    improvement. In rare cases, programs that do not benefit from\n    connection reuse might experience performance degradation if\n    they had been improperly allowing an excessive amount of idle\n    connections to linger; usually by setting\n    Transport.MaxIdleConns to 0 or using different Clients for\n    different requests, thereby bypassing Transport.MaxIdleConns\n    limit. In these cases, setting Transport.DisableKeepAlives to\n    true will disable connection reuse. However, such performance\n    degradation usually indicates improper configuration or usage\n    of Transport or Client in the first place, and a deeper look\n    would likely be beneficial.\n  * net/http: The new Server.MaxHeaderValueCount field allows HTTP\n    servers to control the number of header values that they are\n    willing to accept. If unset, DefaultMaxHeaderValueCount is\n    used.\n  * net/http/httptest: The new NewTestServer function creates a\n    Server configured to use an in-memory fake network suitable for\n    use with the testing/synctest package.\n  * net/url: The new URL.Clone method creates a deep copy of a\n    URL. The new Values.Clone method creates a deep copy of Values.\n  * runtime/secret: Goroutines that are created while in secret\n    mode will now themselves execute in secret mode.\n  * strings: The new CutLast function slices a string around the\n    last occurrence of a separator. It can replace and simplify\n    some common uses of LastIndex.\n  * syscall: On Plan 9, the Errno type is now defined and\n    implements the error interface, as on other platforms. Plan 9\n    system calls return ErrorString values, so Errno is never\n    returned by this package on Plan 9. It is defined so that\n    portable code referring to syscall.Errno builds on Plan 9\n    without build constraints.\n  * testing/synctest: The new Sleep helper function combines\n    time.Sleep and synctest.Wait.\n  * unicode: The unicode package and associated support throughout\n    the system have been upgraded from Unicode 15 to Unicode\n    17. See the Unicode 16.0.0 and Unicode 17.0.0 release notes for\n    information about the changes.\n  * Ports: Darwin: As announced in the Go 1.26 release notes, Go\n    1.27 requires macOS 13 Ventura or later; support for previous\n    versions has been discontinued.\n  * Ports: PowerPC: On the big-endian 64-bit PowerPC port on Linux\n    (GOOS=linux GOARCH=ppc64), the Go toolchain now generates\n    binaries that use the ELFv2 system ABI. ELFv2 support requires\n    Linux kernel 3.13 or later. RHEL7 backported this support to\n    its 3.10 kernel.\n  * Ports: PowerPC: Cgo, position-independent executables (PIE),\n    and external linking are now supported. Using these features\n    requires an ELFv2 compatible runtime (libc and all linked and\n    loaded libraries).\n  * Ports: PowerPC: For programs that do not use cgo, the Go\n    toolchain still generates static binaries with internal linking\n    by default. For programs that have cgo options, if a static,\n    pure-Go binary is needed, one can set the environment variable\n    CGO_ENABLED=0 when running go build.\n\n- CVE-2026-56853 CVE-2026-39821 CVE-2026-56862 CVE-2026-56859 CVE-2026-56860 CVE-2026-56865 CVE-2026-56864 CVE-2026-33818 CVE-2026-56858\n\n  * go#80205 bsc#1275028 security: fix CVE-2026-56853 net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check\n  * go#78760 bsc#1266609 security: fix CVE-2026-39821 x/net/idna: failure to reject ASCII-only Punycode-encoded labels\n  * go#80528 bsc#1275032 security: fix CVE-2026-56862 crypto/tls: limit handshake messages we are willing to accept post-handshake\n  * go#80481 bsc#1275026 security: fix CVE-2026-56859 encoding/xml: add recursion depth guard during decode\n  * go#80494 bsc#1275029 security: fix CVE-2026-56860 net/url: avoid quadratic complexity in resolvePath\n  * go#80744 bsc#1275024 security: fix CVE-2026-56865 x/mod/sumdb/tlog: fix transparency log tile verification bypass\n  * go#80745 bsc#1275025 security: fix CVE-2026-56864 x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup\n  * go#80405 bsc#1275034 security: fix CVE-2026-33818 encoding/asn1: enforce maximum recursion depth\n  * go#80435 bsc#1275033 security: fix CVE-2026-56858 html/template: fix Javascript regexp context tracking\n","status":"published","published":"2026-08-26T14:07:25Z","modified":"2026-08-31T18:23:12.027500291Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4392-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278614).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279215).\n- Verification bypass via public key in legacy bundle (bsc#1282542).\n\nChanges for cosign:\n\n- update to 3.1.3:\n * Auto-detect default digest algorithm for public keys\n * fix(pkcs11key): return an error instead of panicking when no\n key pair matches\n * Supporting OCI Signing with X.509 Certificate Chain\n * fix: prevent shell completions for various options not taking\n filenames\n * fix(blob): compare file checksums case-insensitively in\n * Verification bypass via public key in legacy bundle (GHSA-\n fx35-mq7g-6g98, bsc#1282542)\n","status":"published","published":"2026-09-29T11:49:16Z","modified":"2026-09-30T12:00:04.614217979Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}