gpp_maybe Security update for go1.26-openssl

SUSE-SLE-Module-Development-Tools-15-SP7-2026-2078

This update for go1.26-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response (bsc#1264508). - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1264506). - CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths (bsc#1264505). - CVE-2026-39819: cmd/go: "go bug" follows symlinks in predictable temporary filenames (bsc#1264504). - CVE-2026-39820: net/mail: quadratic string concatentation in consumeComment (bsc#1264503). - CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS (bsc#1264509). - CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters (bsc#1264500). - CVE-2026-39826: html/template: escaper bypass leads to XSS (bsc#1264507). - CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows (bsc#1264501). - CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase (bsc#1264502). - CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database (bsc#1264499). Non security issues: - go1.26 release tracking (bsc#1255111). - Go packages miss binutils-gold dependency (bsc#1170826). - supply a go built with openssl linkage (jsc#SLE-18320).

• Release Date
  May 26 2026
• References
  Bugzilla: 1170826, 1255111, 1264499, 1264500, 1264501, 1264502, 1264503, 1264504, 1264505, 1264506, 1264507, 1264508, 1264509
  CVEs: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501
• Type
  security
• Severity
  important

cloud_download Downloads

Development Tools Module 15.7 ppc64le

• Packages
  go1.26-openssl
  Go compiler with dynamic linkage to OpenSSL libcrypto for use in FIPS mode

  1.26.3-150600.13.6.1 lock rpm lock src

  go1.26-openssl-doc
  Go documentation

  1.26.3-150600.13.6.1 lock rpm

  go1.26-openssl-race
  Go runtime race detector

  1.26.3-150600.13.6.1 lock rpm

Development Tools Module 15.7 aarch64

• Packages
  go1.26-openssl
  Go compiler with dynamic linkage to OpenSSL libcrypto for use in FIPS mode

  1.26.3-150600.13.6.1 lock rpm lock src

  go1.26-openssl-doc
  Go documentation

  1.26.3-150600.13.6.1 lock rpm

  go1.26-openssl-race
  Go runtime race detector

  1.26.3-150600.13.6.1 lock rpm

Development Tools Module 15.7 s390x

• Packages
  go1.26-openssl
  Go compiler with dynamic linkage to OpenSSL libcrypto for use in FIPS mode

  1.26.3-150600.13.6.1 lock rpm lock src

  go1.26-openssl-doc
  Go documentation

  1.26.3-150600.13.6.1 lock rpm

  go1.26-openssl-race
  Go runtime race detector

  1.26.3-150600.13.6.1 lock rpm

Development Tools Module 15.7 x86_64

• Packages
  go1.26-openssl
  Go compiler with dynamic linkage to OpenSSL libcrypto for use in FIPS mode

  1.26.3-150600.13.6.1 lock rpm lock src

  go1.26-openssl-doc
  Go documentation

  1.26.3-150600.13.6.1 lock rpm

  go1.26-openssl-race
  Go runtime race detector

  1.26.3-150600.13.6.1 lock rpm