SUSE-CU-2026:12787-1: Security update of bci/golang
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Oct 24 13:54:06 UTC 2026
SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12787-1
Container Tags : bci/golang:1.26-openssl , bci/golang:1.26-sles15-openssl , bci/golang:1.26.10-openssl , bci/golang:1.26.10-openssl-91.15 , bci/golang:latest , bci/golang:stable-openssl
Container Release : 91.15
Severity : important
Type : security
References : 1255111 1259515 1284687 1284766 1284767 1284768 1284769 1284770
1284771 1284772 1284773 1284774 1284775 1284776 1284777 1284778
1284779 1284780 1286261 1286317 CVE-2026-107161 CVE-2026-111943
CVE-2026-56857 CVE-2026-56866 CVE-2026-78659 CVE-2026-78660 CVE-2026-78663
CVE-2026-78667 CVE-2026-78669 CVE-2026-94439 CVE-2026-94440 CVE-2026-94444
CVE-2026-94447 CVE-2026-94448 CVE-2026-97030 CVE-2026-97031 CVE-2026-97032
-----------------------------------------------------------------
The container bci/golang was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4792-1
Released: Wed Oct 21 09:08:51 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: moderate
References: 1259515
This update for crypto-policies fixes the following issues:
- Disable umac-128* in DEFAULT, FUTURE and BSI openssh policies (bsc#1259515)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4836-1
Released: Wed Oct 21 14:52:06 2026
Summary: Security update for cyrus-sasl
Type: security
Severity: important
References: 1284687,CVE-2026-107161
This update for cyrus-sasl fixes the following issue:
- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
DIGEST-MD5 clients (bsc#1284687).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4866-1
Released: Thu Oct 22 16:37:38 2026
Summary: Security update for go1.26-openssl
Type: security
Severity: important
References: 1255111,1284766,1284767,1284768,1284769,1284770,1284771,1284772,1284773,1284774,1284775,1284776,1284777,1284778,1284779,1284780,1286261,1286317,CVE-2026-111943,CVE-2026-56857,CVE-2026-56866,CVE-2026-78659,CVE-2026-78660,CVE-2026-78663,CVE-2026-78667,CVE-2026-78669,CVE-2026-94439,CVE-2026-94440,CVE-2026-94444,CVE-2026-94447,CVE-2026-94448,CVE-2026-97030,CVE-2026-97031,CVE-2026-97032
This update for go1.26-openssl fixes the following issues:
Update to version 1.26.10 (bsc#1255111, jsc#SLE-18320):
- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).
- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).
- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).
- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).
- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).
- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).
- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).
- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).
- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).
- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).
- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).
- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).
- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).
- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).
- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).
- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,
bsc#1286261).
Changes:
* go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC
* go#81225 runtime: netpoll: eventfd ready for something unexpected
* go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0
* go#81295 cmd/compile: internal compiler error: MoveLoop too small
* go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)
* go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240
* go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)
* go#81668 cmd/compile: go1.27 miscompiles &slice[i].Field on an append-built slice; returned pointer aliases
reused memory
* go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly
* go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency
* go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining
DWARF
* go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures
* go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075
* go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd
* go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26
* go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64
The following package changes have been done:
- crypto-policies-20250714.cd6043a-150700.6.7.1 updated
- libsasl2-3-2.1.28-150600.7.17.1 updated
- libgcc_s1-16.2.0+git9497-150000.1.3.3 updated
- libstdc++6-16.2.0+git9497-150000.1.3.3 updated
- go1.26-openssl-doc-1.26.10-150600.13.18.1 updated
- go1.26-openssl-1.26.10-150600.13.18.1 updated
- go1.26-openssl-race-1.26.10-150600.13.18.1 updated
- container:registry.suse.com-bci-bci-base-15.7-70baa65c3645aa9ea630e8bb9709b5eaf3600ef27049548db7161ce804894dba-0 updated
More information about the sle-container-updates
mailing list