{"id":"CVE-2026-97030","aliases":["ALSA-2026:86093","ALSA-2026:86196","ALSA-2026:86203","AZL-108249","AZL-108299","AZL-108348","AZL-108441","AZL-108534","BELL-CVE-2026-97030","BIT-golang-2026-97030","DEBIAN-CVE-2026-97030","EUVD-2026-95416","GHSA-22jx-p735-qcpm","GO-2026-6600","MGASA-2026-0497","SUSE-SU-2026:24237-1","SUSE-SU-2026:24239-1","SUSE-SU-2026:4625-1","SUSE-SU-2026:4629-1","SUSE-SU-2026:4866-1","SUSE-SU-2026:4867-1","UBUNTU-CVE-2026-97030","openSUSE-SU-2026:12093-1","openSUSE-SU-2026:12101-1","openSUSE-SU-2026:12112-1","openSUSE-SU-2026:22093-1","openSUSE-SU-2026:22095-1"],"status":"published","title":"Recognize yield as regexp preceder keyword in html/template","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00289,"percentile":0.2157,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-08T22:31:09Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.27.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.27.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.26","fixed_in":["1.26.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.27","fixed_in":["1.27.2-1"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gcc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.2.0-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.27.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.27.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.12-1","1.24.13-1","1.24.13-2","1.24.4-1","1.24.4-2","1.24.4-3","1.24.4-4","1.24.7-1","1.24.8-1","1.24.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.2-2","1.26.2-3","1.26.3-1","1.26.3-1~bpo13+1","1.26.3-2","1.26.3-2~bpo13+1","1.26.4-1","1.26.4-1~bpo13+1","1.26.5-1","1.26.5-1~bpo13+1","1.26.6-1","1.26.6-2","1.26.7-1","1.26.7-1~bpo13+1","1.26.8-1","1.26.8-1~bpo13+1","1.26.8-2","1.26~rc2-1","1.26~rc3-1","1.26~rc3-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1"}]}],"versions":["1.27.0-1","1.27.0-1~bpo13+1","1.27.1-1","1.27.1-2","1.27.1-2~bpo13+1","1.27.2-1~bpo13+1","1.27~rc1-1","1.27~rc2-1","1.27~rc3-1"]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~20.04.1","1.22.2-2~20.04.2","1.22.2-2~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3","1.22.2-2~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4","1.22.2-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.2-3","1.26.4-1","1.26.5-1","1.26.6-2","1.26.7-1","1.26.8-1","1.26.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27~rc1-1","1.27~rc2-1","1.27~rc3-1","1.27.0-1","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26~rc3-2","1.26.0-1","1.26.8-1~ubuntu0.26.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13}],"products":[{"vendor":"go standard library","product":"html/template"}],"references":[{"url":"https://go.dev/cl/840925","tags":["web","fix"]},{"url":"https://go.dev/issue/81823","tags":["web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6600","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","tags":["web"]},{"url":"https://github.com/advisories/GHSA-22jx-p735-qcpm"},{"url":"https://access.redhat.com/errata/RHSA-2026:86093","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111943","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78667","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78669","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97031","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548336","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548344","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556068","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-86093.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-56866.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78659.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78660.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78663.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94439.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94440.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94444.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94447.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94448.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-97030.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-97032.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86196","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86196.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86203","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-86203.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-97030","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97030","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0497.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36481","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/08/9","tags":["web","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624237-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272545","tags":["report"]},{"url":"https://bugzilla.suse.com/1284766","tags":["report"]},{"url":"https://bugzilla.suse.com/1284767","tags":["report"]},{"url":"https://bugzilla.suse.com/1284768","tags":["report"]},{"url":"https://bugzilla.suse.com/1284769","tags":["report"]},{"url":"https://bugzilla.suse.com/1284770","tags":["report"]},{"url":"https://bugzilla.suse.com/1284771","tags":["report"]},{"url":"https://bugzilla.suse.com/1284772","tags":["report"]},{"url":"https://bugzilla.suse.com/1284773","tags":["report"]},{"url":"https://bugzilla.suse.com/1284774","tags":["report"]},{"url":"https://bugzilla.suse.com/1284775","tags":["report"]},{"url":"https://bugzilla.suse.com/1284776","tags":["report"]},{"url":"https://bugzilla.suse.com/1284777","tags":["report"]},{"url":"https://bugzilla.suse.com/1284778","tags":["report"]},{"url":"https://bugzilla.suse.com/1284779","tags":["report"]},{"url":"https://bugzilla.suse.com/1284780","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624239-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255111","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264625-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264629-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264866-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264867-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97030","tags":["report"]},{"url":"https://github.com/golang/go/issues/81823","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97030","title":"Recognize yield as regexp preceder keyword in html/template","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T22:53:57.597Z","modified":"2026-10-15T15:30:28.303Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-95416","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T22:53:57Z","modified":"2026-10-15T15:30:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:13.422137Z"}],"ghsa":[{"id":"GHSA-22jx-p735-qcpm","title":"A trusted template author may have previously written a valid template wherein the use of the ...","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-09T00:31:48Z","modified":"2026-10-15T18:32:46Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:13:37.004212Z"}],"nvd":[{"id":"CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05.91Z","modified":"2026-10-15T16:18:24.817Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"BELL-CVE-2026-97030","status":"published","published":"2026-10-10T06:06:55.321092Z","modified":"2026-10-21T07:15:09.746490146Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"DEBIAN-CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05.91Z","modified":"2026-10-16T10:02:18.083936767Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"UBUNTU-CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:00Z","modified":"2026-10-19T17:00:18.709428291Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"ALSA-2026:86093","title":"Important: golang security, bug fix, and enhancement update","description":"The golang packages provide the Go programming language compiler.  \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:42:19.545498615Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86196","title":"Important: golang security, bug fix, and enhancement update","description":"The golang packages provide the Go programming language compiler.  \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:42:24.624651287Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86203","title":"Important: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.   \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:12:06.542723063Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-108249","title":"CVE-2026-97030 affecting package golang 1.26.10-1","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-108299","title":"CVE-2026-97030 affecting package golang 1.27.3-1","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-108348","title":"CVE-2026-97030 affecting package gcc 13.2.0-7","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-108441","title":"CVE-2026-97030 affecting package python-tensorboard 2.16.2-6","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-108534","title":"CVE-2026-97030 affecting package tensorflow 2.16.1-11","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"BIT-golang-2026-97030","title":"Recognize yield as regexp preceder keyword in html/template","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-16T08:40:14.207Z","modified":"2026-10-16T09:55:33.02306158Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2026-6600","title":"Recognize yield as regexp preceder keyword in html/template","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.\n\nWe now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","status":"published","published":"2026-10-08T22:31:09Z","modified":"2026-10-16T09:55:33.02306158Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"MGASA-2026-0497","title":"Updated golang packages fix security vulnerabilities","description":"net/http: HTTP/2 server crash due to HPACK encoder race\nnet/http: HTTP/2 server memory exhaustion due to Trailer headers\ncrypto/tls: reject malformed ECH outer extension references\ncmd/go: checksum bypass for golang.org/fips140\ncmd/go: checksum database bypass for golang.org/toolchain\nhtml/template: reset context tracking on consecutive template\nexpressions\nhtml/template: recognize |yield| as regexp preceder keyword\nnet/textproto, mime/multipart: memory limit bypass when parsing MIME\nheaders\nnet/http: HTTP/1 client connection desynchronization after CONNECT\nrejection\nnet/http: HTTP/1 server connection desynchronization after 2xx CONNECT\nresponse\nnet/http: excessive CPU consumption from repeated initial window changes\nnet/http: HTTP/2 transport accepts malformed framing-related headers\nnet/http: lack of limit on size of parsed Range headers\nnet/http: double flow control refund on HTTP/2 server streams\n","status":"published","published":"2026-10-13T01:20:53Z","modified":"2026-10-13T01:42:53.609450881Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12093-1","title":"go1.26-1.26.9-1.1 on GA media","description":"These are all security issues fixed in the go1.26-1.26.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-09T00:00:00Z","modified":"2026-10-10T17:23:22.436651438Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12101-1","title":"go1.27-1.27.2-1.1 on GA media","description":"These are all security issues fixed in the go1.27-1.27.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.867263309Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12112-1","title":"rclone-1.75.2-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.75.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-13T10:30:04.88132213Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22093-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T12:02:27Z","modified":"2026-10-19T17:23:13.686380094Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22095-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T15:18:05Z","modified":"2026-10-19T17:23:13.634582243Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24237-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T12:03:33Z","modified":"2026-10-21T17:23:11.742264883Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24239-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T15:22:17Z","modified":"2026-10-21T17:23:11.945901699Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4625-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-12T08:25:05Z","modified":"2026-10-13T10:30:05.897991531Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4629-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-12T15:15:26Z","modified":"2026-10-13T10:30:05.951862663Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4866-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.10 (bsc#1255111, jsc#SLE-18320):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,\n  bsc#1286261).\n\nChanges:\n\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases \n   reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining \n   DWARF\n * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures\n * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075\n * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd\n * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26\n * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64\n","status":"published","published":"2026-10-22T14:38:04Z","modified":"2026-10-23T10:30:03.801269439Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4867-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.10 (bsc#1255111, jsc#SLE-18320):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,\n  bsc#1286261).\n\nChanges:\n\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases \n   reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining \n   DWARF\n * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures\n * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075\n * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd\n * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26\n * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64\n","status":"published","published":"2026-10-22T15:06:56Z","modified":"2026-10-23T10:30:04.00006771Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}