SUSE-SU-2026:3816-1

This update for go1.26-openssl fixes the following issues:

Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.

Security issues fixed:

• CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
• CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
• CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level { can lead to XSS (bsc#1275033).
• CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
• CVE-2026-56860: net/url: quadratic complexity in resolvePath when processing backtrack path elements can lead to denial of service (bsc#1275029).
• CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
• CVE-2026-56864: x/mod/sumdb: a malicious GOSUMDB is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
• CVE-2026-56865: x/mod/sumdb/tlog: a malicious GOPROXY is capable of forging sumdb tiles, which allows for bypass of the GOSUMDB check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

• Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips: (jsc#SLE-18320).
  • Rebase to 1.26.7
  • Support strictfipsruntime with no_openssl
  • Fix multiple no_openssl build tag issues
• go1.26.7 (released 2026-08-19, boo#1255111):
  • go#80927 net/http: ReadHeaderTimeout remains active after unencrypted HTTP/2 handoff
• go1.26.6 (released 2026-08-13):
  • includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages, as well as bug fixes to the compiler, the linker, the runtime, and the crypto/tls and os packages.
  • go#79876 cmd/compile: prove misscompilation in slicemask folding leaves garbage in the upper bits
  • go#80099 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr
  • go#80131 cmd/link: peCreateExportFile generates invalid .def file when output name has trailing dot (c-shared on Windows)
  • go#80365 os: Root's MkdirAll can't create paths ending in forward slashes
  • go#80367 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880
  • go#80369 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880
  • go#80394 runtime: arm64 found pointer to free object with safe code
  • go#80441 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer
  • go#80478 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field
  • go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
  • go#80579 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills
  • go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
  • go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record
  • go#80615 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic
  • go#80617 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames
  • go#80619 cmd/compile: prove bug causes invalid indirect call
  • go#80715 runtime: fpTracebackPartialExpand SIGSEGV under high panic load
• Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:
  • Limit openssl RandReader concurrency