OPENSUSE-SU-2026:21593-1
Vulnerability from csaf_opensuse - Published: 2026-08-19 09:08 - Updated: 2026-08-19 09:08Summary
Security update for go1.26
Severity
Important
Notes
Title of the patch: Security update for go1.26
Description of the patch: This update for go1.26 fixes the following issues:
Update to go1.26.6 (released 2026-08-13, bsc#1255111).
Security issues fixed:
- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,
recursive structures (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service
(bsc#1275028).
- CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).
- CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion
and a denial of service (bsc#1275026).
- CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can lead to high
memory allocation overhead and a denial of service (bsc#1275029).
- CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service
(bsc#1275032).
- CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content (bsc#1275025).
- CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input
and can lead to malicious module content to be accepted (bsc#1275024).
Changes for go1.26.6:
- go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
- go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
- go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on
Windows)
- go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
- go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
- go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
- go#80394 runtime: arm64 found pointer to free object with safe code
- go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following
garbage stack data as a pointer
- go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
- go#80499 runtime: js/wasm: "found bad pointer in Go heap" -- link-layout-constant value recorded as a pointer in
the write-barrier buffer
- go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
- go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
- go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
- go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
- go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
- go#80619 cmd/compile: prove bug causes invalid indirect call
- go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load
Patchnames: openSUSE-Leap-16.0-1463
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for go1.26",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for go1.26 fixes the following issues:\n\nUpdate to go1.26.6 (released 2026-08-13, bsc#1255111).\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested,\n recursive structures (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service\n (bsc#1275028).\n- CVE-2026-56858: html/template: improper Javascript regexp context tracking allows for XSS attacks (bsc#1275033).\n- CVE-2026-56859: encoding/xml: missing recursion depth guard during decode operation can lead to stack exhaustion\n and a denial of service (bsc#1275026).\n- CVE-2026-56860: net/url: quadratic time complexity in `resolvePath` when processing certain input can lead to high\n memory allocation overhead and a denial of service (bsc#1275029).\n- CVE-2026-56862: crypto/tls: no limit set for handshake messages sent post-handshake allows for denial of service\n (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: unauthenticated hashes accepted in `Lookup` allows for a coordinating GOPROXY and\n GOSUMDB to serve a client malicious module content (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: improper transparency log tile verification allows for bypass on crafted input\n and can lead to malicious module content to be accepted (bsc#1275024).\n\nChanges for go1.26.6:\n\n- go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits\n- go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n- go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on\n Windows)\n- go#80365 os: Root\u0027s MkdirAll can\u0027t create paths ending in forward slashes\n- go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n- go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n- go#80394 runtime: arm64 found pointer to free object with safe code\n- go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following\n garbage stack data as a pointer\n- go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n- go#80499 runtime: js/wasm: \"found bad pointer in Go heap\" -- link-layout-constant value recorded as a pointer in\n the write-barrier buffer\n- go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n- go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n- go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record\n- go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn\u0027t fit 32bits resulting in panic\n- go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n- go#80619 cmd/compile: prove bug causes invalid indirect call\n- go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1463",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21593-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1255111",
"url": "https://bugzilla.suse.com/1255111"
},
{
"category": "self",
"summary": "SUSE Bug 1266609",
"url": "https://bugzilla.suse.com/1266609"
},
{
"category": "self",
"summary": "SUSE Bug 1275024",
"url": "https://bugzilla.suse.com/1275024"
},
{
"category": "self",
"summary": "SUSE Bug 1275025",
"url": "https://bugzilla.suse.com/1275025"
},
{
"category": "self",
"summary": "SUSE Bug 1275026",
"url": "https://bugzilla.suse.com/1275026"
},
{
"category": "self",
"summary": "SUSE Bug 1275028",
"url": "https://bugzilla.suse.com/1275028"
},
{
"category": "self",
"summary": "SUSE Bug 1275029",
"url": "https://bugzilla.suse.com/1275029"
},
{
"category": "self",
"summary": "SUSE Bug 1275032",
"url": "https://bugzilla.suse.com/1275032"
},
{
"category": "self",
"summary": "SUSE Bug 1275033",
"url": "https://bugzilla.suse.com/1275033"
},
{
"category": "self",
"summary": "SUSE Bug 1275034",
"url": "https://bugzilla.suse.com/1275034"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33818 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33818/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56853 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56853/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56858 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56858/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56859 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56859/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56860 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56860/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56862 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56862/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56864 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56864/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56865 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56865/"
}
],
"title": "Security update for go1.26",
"tracking": {
"current_release_date": "2026-08-19T09:08:44Z",
"generator": {
"date": "2026-08-19T09:08:44Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21593-1",
"initial_release_date": "2026-08-19T09:08:44Z",
"revision_history": [
{
"date": "2026-08-19T09:08:44Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "go1.26-1.26.6-160000.1.1.aarch64",
"product": {
"name": "go1.26-1.26.6-160000.1.1.aarch64",
"product_id": "go1.26-1.26.6-160000.1.1.aarch64"
}
},
{
"category": "product_version",
"name": "go1.26-doc-1.26.6-160000.1.1.aarch64",
"product": {
"name": "go1.26-doc-1.26.6-160000.1.1.aarch64",
"product_id": "go1.26-doc-1.26.6-160000.1.1.aarch64"
}
},
{
"category": "product_version",
"name": "go1.26-race-1.26.6-160000.1.1.aarch64",
"product": {
"name": "go1.26-race-1.26.6-160000.1.1.aarch64",
"product_id": "go1.26-race-1.26.6-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.26-1.26.6-160000.1.1.ppc64le",
"product": {
"name": "go1.26-1.26.6-160000.1.1.ppc64le",
"product_id": "go1.26-1.26.6-160000.1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "go1.26-doc-1.26.6-160000.1.1.ppc64le",
"product": {
"name": "go1.26-doc-1.26.6-160000.1.1.ppc64le",
"product_id": "go1.26-doc-1.26.6-160000.1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "go1.26-race-1.26.6-160000.1.1.ppc64le",
"product": {
"name": "go1.26-race-1.26.6-160000.1.1.ppc64le",
"product_id": "go1.26-race-1.26.6-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.26-1.26.6-160000.1.1.s390x",
"product": {
"name": "go1.26-1.26.6-160000.1.1.s390x",
"product_id": "go1.26-1.26.6-160000.1.1.s390x"
}
},
{
"category": "product_version",
"name": "go1.26-doc-1.26.6-160000.1.1.s390x",
"product": {
"name": "go1.26-doc-1.26.6-160000.1.1.s390x",
"product_id": "go1.26-doc-1.26.6-160000.1.1.s390x"
}
},
{
"category": "product_version",
"name": "go1.26-race-1.26.6-160000.1.1.s390x",
"product": {
"name": "go1.26-race-1.26.6-160000.1.1.s390x",
"product_id": "go1.26-race-1.26.6-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.26-1.26.6-160000.1.1.x86_64",
"product": {
"name": "go1.26-1.26.6-160000.1.1.x86_64",
"product_id": "go1.26-1.26.6-160000.1.1.x86_64"
}
},
{
"category": "product_version",
"name": "go1.26-doc-1.26.6-160000.1.1.x86_64",
"product": {
"name": "go1.26-doc-1.26.6-160000.1.1.x86_64",
"product_id": "go1.26-doc-1.26.6-160000.1.1.x86_64"
}
},
{
"category": "product_version",
"name": "go1.26-race-1.26.6-160000.1.1.x86_64",
"product": {
"name": "go1.26-race-1.26.6-160000.1.1.x86_64",
"product_id": "go1.26-race-1.26.6-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-1.26.6-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64"
},
"product_reference": "go1.26-1.26.6-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-1.26.6-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le"
},
"product_reference": "go1.26-1.26.6-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-1.26.6-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x"
},
"product_reference": "go1.26-1.26.6-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-1.26.6-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64"
},
"product_reference": "go1.26-1.26.6-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-1.26.6-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64"
},
"product_reference": "go1.26-doc-1.26.6-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-1.26.6-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le"
},
"product_reference": "go1.26-doc-1.26.6-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-1.26.6-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x"
},
"product_reference": "go1.26-doc-1.26.6-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-1.26.6-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64"
},
"product_reference": "go1.26-doc-1.26.6-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-1.26.6-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64"
},
"product_reference": "go1.26-race-1.26.6-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-1.26.6-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le"
},
"product_reference": "go1.26-race-1.26.6-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-1.26.6-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x"
},
"product_reference": "go1.26-race-1.26.6-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-1.26.6-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
},
"product_reference": "go1.26-race-1.26.6-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33818",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33818"
}
],
"notes": [
{
"category": "general",
"text": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33818",
"url": "https://www.suse.com/security/cve/CVE-2026-33818"
},
{
"category": "external",
"summary": "SUSE Bug 1275034 for CVE-2026-33818",
"url": "https://bugzilla.suse.com/1275034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "important"
}
],
"title": "CVE-2026-33818"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-56853",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56853"
}
],
"notes": [
{
"category": "general",
"text": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56853",
"url": "https://www.suse.com/security/cve/CVE-2026-56853"
},
{
"category": "external",
"summary": "SUSE Bug 1275028 for CVE-2026-56853",
"url": "https://bugzilla.suse.com/1275028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "important"
}
],
"title": "CVE-2026-56853"
},
{
"cve": "CVE-2026-56858",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56858"
}
],
"notes": [
{
"category": "general",
"text": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56858",
"url": "https://www.suse.com/security/cve/CVE-2026-56858"
},
{
"category": "external",
"summary": "SUSE Bug 1275033 for CVE-2026-56858",
"url": "https://bugzilla.suse.com/1275033"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "moderate"
}
],
"title": "CVE-2026-56858"
},
{
"cve": "CVE-2026-56859",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56859"
}
],
"notes": [
{
"category": "general",
"text": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56859",
"url": "https://www.suse.com/security/cve/CVE-2026-56859"
},
{
"category": "external",
"summary": "SUSE Bug 1275026 for CVE-2026-56859",
"url": "https://bugzilla.suse.com/1275026"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "important"
}
],
"title": "CVE-2026-56859"
},
{
"cve": "CVE-2026-56860",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56860"
}
],
"notes": [
{
"category": "general",
"text": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56860",
"url": "https://www.suse.com/security/cve/CVE-2026-56860"
},
{
"category": "external",
"summary": "SUSE Bug 1275029 for CVE-2026-56860",
"url": "https://bugzilla.suse.com/1275029"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "moderate"
}
],
"title": "CVE-2026-56860"
},
{
"cve": "CVE-2026-56862",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56862"
}
],
"notes": [
{
"category": "general",
"text": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56862",
"url": "https://www.suse.com/security/cve/CVE-2026-56862"
},
{
"category": "external",
"summary": "SUSE Bug 1275032 for CVE-2026-56862",
"url": "https://bugzilla.suse.com/1275032"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "important"
}
],
"title": "CVE-2026-56862"
},
{
"cve": "CVE-2026-56864",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56864"
}
],
"notes": [
{
"category": "general",
"text": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56864",
"url": "https://www.suse.com/security/cve/CVE-2026-56864"
},
{
"category": "external",
"summary": "SUSE Bug 1275025 for CVE-2026-56864",
"url": "https://bugzilla.suse.com/1275025"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "moderate"
}
],
"title": "CVE-2026-56864"
},
{
"cve": "CVE-2026-56865",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56865"
}
],
"notes": [
{
"category": "general",
"text": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56865",
"url": "https://www.suse.com/security/cve/CVE-2026-56865"
},
{
"category": "external",
"summary": "SUSE Bug 1275024 for CVE-2026-56865",
"url": "https://bugzilla.suse.com/1275024"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-doc-1.26.6-160000.1.1.x86_64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.aarch64",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.ppc64le",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.s390x",
"openSUSE Leap 16.0:go1.26-race-1.26.6-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-19T09:08:44Z",
"details": "important"
}
],
"title": "CVE-2026-56865"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…