SUSE-CU-2026:12165-1: Security update of bci/golang

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Tue Oct 13 09:51:34 UTC 2026 

SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12165-1
Container Tags        : bci/golang:1.26-openssl , bci/golang:1.26-sles15-openssl , bci/golang:1.26.7-openssl , bci/golang:1.26.7-openssl-91.6 , bci/golang:latest , bci/golang:stable-openssl
Container Release     : 91.6
Severity              : important
Type                  : security
References            : 1249584 1257144 1257496 1259711 1259726 1259729 1262263 1264713
                        1267631 1268572 1268573 1275115 1275594 1275732 1275859 1275860
                        1275915 1282347 1283493 1284334 CVE-2016-0718 CVE-2016-9063 CVE-2022-43680
                        CVE-2023-52425 CVE-2024-8176 CVE-2025-59375 CVE-2026-102633 CVE-2026-24515
                        CVE-2026-25210 CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 CVE-2026-41080
                        CVE-2026-45186 CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403
                        CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407 CVE-2026-56408
                        CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412 CVE-2026-66046
                        CVE-2026-72522 CVE-2026-76641 CVE-2026-76956 CVE-2026-76957 CVE-2026-77214
                        CVE-2026-93990 
-----------------------------------------------------------------

The container bci/golang was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4619-1
Released:    Mon Oct 12 09:22:38 2026
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1249584,1257144,1257496,1259711,1259726,1259729,1262263,1264713,1267631,1268572,1268573,1275115,1275594,1275732,1275859,1275860,1275915,1282347,1283493,1284334,CVE-2016-0718,CVE-2016-9063,CVE-2022-43680,CVE-2023-52425,CVE-2024-8176,CVE-2025-59375,CVE-2026-102633,CVE-2026-24515,CVE-2026-25210,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778,CVE-2026-41080,CVE-2026-45186,CVE-2026-50219,CVE-2026-56131,CVE-2026-56132,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,CVE-2026-56411,CVE-2026-56412,CVE-2026-66046,CVE-2026-72522,CVE-2026-76641,CVE-2026-76956,CVE-2026-76957,CVE-2026-77214,CVE-2026-93990
This update for expat fixes the following issues:

- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the
  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
  declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition
  (bsc#1259729).
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a
  policy violation (bsc#1267631).
- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within
  handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,
  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,
  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()
  function (bsc#1275732).
- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
  as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger
  memory corruption (bsc#1275915).
- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-
  after-free can occur (bsc#1275859).
- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).
- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):
	
 * Bug fixes:
 * Fix an OOM-related memory leak on a failed overflow check
 * Fix memory alignment for architectures with 128bit pointers
 * Mark XML_SetHashSalt deprecated
 * CMake: only add /source-charset:utf-8 when /utf-8 is not present
 * lib: resolve undefined behavior from overshifting a signed int
 * lib: support read-only hash table lookup with non-zero-terminated
 keys
 * lib: use a C99 bool for ENTITY.open
 * version info bumped from 13:3:12 to 13:4:12
 * fix support for 2+ GiB documents (regression from 2.8.2)
 * reject empty version in the XML declaration
 * fix printf format for AIX
 * CMake|AIX: enable EXPAT_DEV_URANDOM by default
 * version info bumped from 13:2:12 to 13:3:12
 * Existing API function XML_SetHashSalt is now deprecated
 * because of its limitations, and its use should be
 * considered a vulnerability. Please either use the new API
 * function XML_SetHashSalt16Bytes (with known-high-quality
 * entropy input only!) instead, or leave the derivation of
 * a 16-bytes hash salt from high quality entropy to Expat's
 * internal machinery (by *not* calling either of the two
 * XML_SetHashSalt* functions).
 * xmlwf: Fix a memory leak
 * WASI: Fix format specifiers for 32bit WASI SDK
 * Fix alignment of internal allocations for some non-amd64
 architectures (e.g. sparc32); fixes up on the fix to
 CVE-2025-59375 (of Expat 2.7.2)
 * Fix a class of false positives where input should have been
 rejected with error XML_ERROR_ASYNC_ENTITY; regression from
 CVE-2024-8176 (of Expat 2.7.0)
 * Prove and regression-proof absence of integer overflow
 from function expat_realloc
 * Remove 'harmless' cast that truncated a size_t to unsigned
 * xmlwf: Resolve use of functions XML_GetErrorLineNumber
 and XML_GetErrorColumnNumber
 * CVE-2025-59375 -- Disallow use of disproportional amounts of
 dynamic memory from within an Expat parser
 * xmlwf: Fix (internal) help generator
 * xmlwf: Mention supported environment variables in


The following package changes have been done:

- libexpat1-2.8.5-150700.3.15.1 updated

More information about the sle-container-updates mailing list