SUSE-CU-2026:9283-1: Security update of bci/golang

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:9283-1
Container Tags        : bci/golang:1.26-openssl , bci/golang:1.26-sles15-openssl , bci/golang:1.26.7-openssl , bci/golang:1.26.7-openssl-90.4 , bci/golang:latest , bci/golang:stable-openssl
Container Release     : 90.4
Severity              : important
Type                  : security
References            : 1255111 1266609 1275024 1275025 1275026 1275028 1275029 1275032
                        1275033 1275034 CVE-2026-33818 CVE-2026-39821 CVE-2026-56853
                        CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864
                        CVE-2026-56865 
-----------------------------------------------------------------

The container bci/golang was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3816-1
Released:    Wed Aug 26 13:02:31 2026
Summary:     Security update for go1.26-openssl
Type:        security
Severity:    important
References:  1255111,1266609,1275024,1275025,1275026,1275028,1275029,1275032,1275033,1275034,CVE-2026-33818,CVE-2026-39821,CVE-2026-56853,CVE-2026-56858,CVE-2026-56859,CVE-2026-56860,CVE-2026-56862,CVE-2026-56864,CVE-2026-56865
This update for go1.26-openssl fixes the following issues:

Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.
  
Security issues fixed:

- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial
  of service (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
  bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support
  unencrypted HTTP/2 allows for denial of service (bsc#1275028).
- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS
  (bsc#1275033).
- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can
  lead to denial of service (bsc#1275026).
- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to
  denial of service (bsc#1275029).
- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to
  a denial of service (bsc#1275032).
- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained
  within the transparency log (bsc#1275025).
- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of
  the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:
  (jsc#SLE-18320).
  * Rebase to 1.26.7
  * Support `strictfipsruntime` with `no_openssl`
  * Fix multiple `no_openssl` build tag issues
- go1.26.7 (released 2026-08-19, boo#1255111):
  * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff
- go1.26.6 (released 2026-08-13):
  * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,
    `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the
    runtime, and the `crypto/tls` and `os` packages.
  * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits
  * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
  * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared`
    on Windows)
  * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
  * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
  * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
  * go#80394 runtime: `arm64` found pointer to free object with safe code
  * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following
    garbage stack data as a pointer
  * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
  * go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in
    the write-barrier buffer
  * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of
    spills
  * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record
  * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic
  * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames
  * go#80619 cmd/compile: `prove` bug causes invalid indirect call
  * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:
  * Limit `openssl` `RandReader` concurrency


The following package changes have been done:

- go1.26-openssl-doc-1.26.7-150600.13.15.1 updated
- go1.26-openssl-1.26.7-150600.13.15.1 updated
- go1.26-openssl-race-1.26.7-150600.13.15.1 updated