SUSE-SU-2026:3630-1

This update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 fixes the following issues:

• CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic complexity when parsing HTML documents allow for denial of service (bsc#1251420).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: no validation of message size when processing new identity requests can cause a panic due to an out-of-bounds read (bsc#1254014).
• CVE-2025-58181: golang.org/x/crypto/ssh: no validation of number of mechanisms in GSSAPI authentication requests can cause unbounded memory consumption (bsc#1253935).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input can lead to a denial of service (bsc#1251615).
• CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification (bsc#1269093).
• CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).
• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267120).
• CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted SETTINGS_MAX_FRAME_SIZE can lead to an infinite loop and a denial of service (bsc#1265736).
• CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame parser allows for a denial of service via crafted SPDY frames (bsc#1262265).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266575).
• CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer can lead to panic (bsc#1273606).
• CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272000).

Other updates and bugfixes:

• Fixed printf-style calls with non-constant format strings (cmd/virt-chroot, tests/) that fail go1.25's vet (toolchain required by the x/net 0.55.0 re-vendor); rewritten with no behavior change.
• Build with Go >= 1.25 (required by golang.org/x/net 0.55).