SUSE-CU-2026:9279-1: Security update of bci/golang

Thu Aug 27 09:37:39 UTC 2026

SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:9279-1
Container Tags        : bci/golang:1.25-openssl , bci/golang:1.25-sles15-openssl , bci/golang:1.25.14-openssl , bci/golang:1.25.14-openssl-90.4 , bci/golang:oldstable-openssl
Container Release     : 90.4
Severity              : important
Type                  : security
References            : 1244485 1266609 1275024 1275025 1275026 1275028 1275029 1275032
                        1275033 1275034 CVE-2026-33818 CVE-2026-39821 CVE-2026-56853
                        CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864
                        CVE-2026-56865 
-----------------------------------------------------------------

The container bci/golang was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3815-1
Released:    Wed Aug 26 13:02:01 2026
Summary:     Security update for go1.25-openssl
Type:        security
Severity:    important
References:  1244485,1266609,1275024,1275025,1275026,1275028,1275029,1275032,1275033,1275034,CVE-2026-33818,CVE-2026-39821,CVE-2026-56853,CVE-2026-56858,CVE-2026-56859,CVE-2026-56860,CVE-2026-56862,CVE-2026-56864,CVE-2026-56865
This update for go1.25-openssl fixes the following issues:

Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial
  of service (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
  bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support
  unencrypted HTTP/2 allows for denial of service (bsc#1275028).
- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS
  (bsc#1275033).
- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can
  lead to denial of service (bsc#1275026).
- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to
  denial of service (bsc#1275029).
- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to
  a denial of service (bsc#1275032).
- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained
  within the transparency log (bsc#1275025).
- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of
  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

- Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips:
  (jsc#SLE-18320):
  * Rebase to 1.25.14
- go1.25.14 (released 2026-08-19, boo#1244485):
  * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff
- go1.25.13 (released 2026-08-13):
  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`,
    `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os`
    packages.
  * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits
  * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
  * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
  * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
  * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
  * go#80393 runtime: `arm64` found pointer to free object with safe code
  * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following
    garbage stack data as a pointer
  * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
  * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the
    write-barrier buffer
  * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of
    spills
  * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic
  * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames
  * go#80618 cmd/compile: `prove` bug causes invalid indirect call
  * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
- Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:
  * Limit openssl `RandReader` concurrency (#374)

The following package changes have been done:

- go1.25-openssl-doc-1.25.14-150600.13.27.1 updated
- go1.25-openssl-1.25.14-150600.13.27.1 updated
- go1.25-openssl-race-1.25.14-150600.13.27.1 updated